{"id":"CVE-2026-98503","kind":"vulnerability","aliases":["CVE-2026-98503"],"related":[],"title":"Linux kernel: AF_PACKET TX_RING slot can be reused while in flight","description":"In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use ubuf_info completion for TX_RING packets\n\ntpacket_snd sends skbs with frags pointing into its ring slots. Slots\nare released when skb->destructor is called.\n\nA call to skb_orphan calls skb->destructor before the skb is freed.\nThis can cause the slot to be reused while still linked into the skb.\n\nSwitch to standard zerocopy completion (ubuf_info) so the slot is only\nreleased once all references to the payload are freed or copied.\nRestore skb->destructor to standard sock_wfree.\n\nThe ubuf_info completion callback can be called with a NULL skb, but\nonly from net_zcopy_put and related API, used by zerocopy implementations\nthat hold their own reference on the uarg, such as MSG_ZEROCOPY. This\nuarg is only ever completed from skb_zcopy_clear, so skb is always set.\n\nTo prevent userspace from aliasing in-flight state on shared ring\nslots, allocate tpacket_uarg per packet, rather than per slot. This\nadds a small allocation to the transmit path. Use standard kmalloc to\nallow backporting to stable kernels.\n\nThe uarg holds an sk_wmem_alloc reference, rather than an sk_refcnt\nreference. packet_free_tx_ring waits on sk_wmem_alloc before freeing\nthe ring pages. Always allocate vec->deferred for tx_ring so page-backed\nrings also wait on sk_wmem_alloc when skb_copy_ubufs drops page refs\nbefore calling tpacket_ubuf_complete.\n\nDrop the tx_ring.pg_vec test that tpacket_destruct_skb performed before\naccessing the slot. The sk_wmem_alloc reference now guarantees that the\nslot is valid. The test is also not sufficient by itself, as it reads\npg_vec without pg_vec_lock, so it can race with packet_set_ring.\n\nAs a result a slot is released when its payload is copied, which can\nbe before transmission (e.g., in skb_orphan_frags_rx). If copied\nbefore skb_tx_timestamp() is called, no slot timestamp is recorded,\nsimilar to when skb_orphan() was called early in the datapath before\nthis patch.\n\nRevert the now unused previous skb_zcopy_.._nouarg infra.\n\nDepends on commit 992cc9f94ca9 (\"net/packet: defer vmalloc TX_RING\nfree until skbs finish\").","summary":"The Linux kernel's packet socket TX_RING code could release a ring slot while the sent skb still referenced its payload, because skb orphaning called the destructor early. The fix switches TX_RING to standard zerocopy completion so a slot is freed only after its payload references are released.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["af_packet","kernel","linux","runtime"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:01+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","triaged_at":"2026-10-25T05:25:30+00:00","updated_at":"2026-10-25T05:25:30+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T05:25:30Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: AF_PACKET TX_RING slot can be reused while in flight","impact":"medium","summary":"The Linux kernel's packet socket TX_RING code could release a ring slot while the sent skb still referenced its payload, because skb orphaning called the destructor early. The fix switches TX_RING to standard zerocopy completion so a slot is freed only after its payload references are released.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","af_packet"],"confidence":0.5,"needs_auth":"unknown","worst_case":"unknown","analyst_note":"Check the NVD entry and the upstream kernel commit for affected kernel version ranges, required privileges (AF_PACKET use typically needs CAP_NET_RAW) and the stable backport versions.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000589,"input_tokens":4034,"output_tokens":372,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98503':16A,19A '992cc9f94ca9':433C 'access':331C 'add':245C 'af':3A,20B 'alias':226C 'alloc':235C,248C,268C,284C,291C,307C,337C 'allow':257C 'also':302C,349C 'alway':220C,290C 'api':190C 'back':300C 'backport':258C 'call':50B,112C,114C,118C,177C,316C,401C,413C 'callback':174C 'caus':128C 'clear':216C 'code':33B 'commit':432C 'complet':62B,89C,144C,173C,212C,319C 'copi':162C,310C,382C,395C 'could':34B 'cve':14A,17A 'datapath':417C 'defer':293C,435C 'depend':430C 'destruct':327C 'destructor':52B,110C,120C,165C 'drop':312C,320C 'e.g':388C 'earli':53B,414C 'ever':211C 'finish':442C 'fix':55B 'flight':13A,229C 'follow':80C 'frag':99C,392C 'free':277C,286C,439C 'freed':67B,125C,160C 'guarante':340C 'hold':196C,264C 'implement':194C 'in-flight':227C 'info':88C,146C,172C 'infra':429C 'kernel':2A,22B,27B,78C,261C 'kmalloc':255C 'link':136C 'linux':1A,23B,26B,77C 'lock':362C 'msg':205C 'net':185C 'net/packet':434C 'nouarg':428C 'null':180C 'orphan':49B,117C,391C,411C 'packet':4A,21B,29B,85C,93C,239C,276C,368C 'page':289C,299C,313C 'page-back':298C 'patch':420C 'path':252C 'payload':46B,71B,158C,380C 'per':238C,242C 'perform':329C 'pg':357C,360C 'point':100C 'prevent':223C 'previous':425C 'put':187C 'race':366C 'rather':240C,270C 'read':356C 'record':406C 'ref':314C 'refcnt':274C 'refer':72B,155C,199C,269C,275C,338C 'referenc':44B 'relat':189C 'releas':35B,74B,107C,152C,377C 'resolv':84C 'restor':163C 'result':373C 'reus':10A,133C 'revert':421C 'ring':6A,32B,37B,58B,92C,103C,233C,279C,288C,296C,301C,370C,438C 'runtim':24B 'rx':393C 'send':96C 'sent':41B 'set':221C,369C 'share':232C 'similar':407C 'sk':266C,273C,282C,305C,335C 'skb':42B,48B,109C,116C,119C,123C,139C,164C,181C,214C,218C,309C,328C,390C,397C,410C,426C 'skbs':97C,441C 'slot':7A,38B,65B,104C,105C,130C,149C,234C,243C,333C,343C,375C,403C 'small':247C 'snd':95C 'sock':168C 'socket':30B 'stabl':260C 'standard':60B,142C,167C,254C 'state':230C 'still':43B,135C 'suffici':351C 'switch':56B,140C 'test':324C,347C 'timestamp':399C,404C 'tpacket':94C,236C,317C,326C 'transmiss':387C 'transmit':251C 'tx':5A,31B,57B,91C,278C,295C,398C,437C 'tx_ring.pg':322C 'uarg':202C,208C,237C,263C 'ubuf':87C,145C,171C,311C,318C 'unus':424C 'use':86C,191C,253C 'userspac':224C 'valid':345C 'vec':292C,323C,358C,361C 'vmalloc':436C 'vulner':81C 'wait':280C,303C 'wfree':169C 'without':359C 'wmem':267C,283C,306C,336C 'zcopi':186C,215C,427C 'zerocopi':61B,143C,193C,206C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:01+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98503","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98503","severity":null,"published_at":"2026-10-18T16:17:01+00:00","modified_at":"2026-10-19T10:19:03+00:00","first_seen_at":"2026-10-23T21:57:15+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}