{"id":"CVE-2026-98643","kind":"vulnerability","aliases":["CVE-2026-98643"],"related":[],"title":"Linux kernel BPF sockops: out-of-bounds read leaks kernel memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf: Fix out-of-bounds read of rtt_min in sock_ops\n\nA sockops prog reading skops->rtt_min never checks the sk type: on the\ntcp_conn_request() path sock_ops->sk is a request_sock (non-full), and the\nctx rewrite casts it to a tcp_sock (full) and reads rtt_min past the end of\nthe request_sock, returning dirty adjacent memory.\n\n\tSEC(\"sockops\")\n\tint prog(struct bpf_sock_ops *skops)\n\t{\n\t\tswitch (skops->op) {\n\t\tcase BPF_SOCK_OPS_RWND_INIT:\n\t\t\tleak = skops->rtt_min;   /* reads the request_sock OOB */\n\t\t...\n\t\t}\n\t}\n\nFor instance one such read returned rtt_min=0xffff8881, the high half of a\nleaked kernel pointer.\n\nGuarding that cast is exactly what SOCK_OPS_GET_FIELD() does -- it checks\nis_locked_tcp_sock and returns 0 when sock_ops->sk is not a locked full\nsocket. Every other tcp_sock field in sock_ops goes through it; rtt_min is\nthe only one open-coded, so it skips the check.\n\nRead rtt_min through SOCK_OPS_GET_FIELD() too. rtt_min is a bit special:\nit is a struct minmax and we only want the current min, so pass\nrtt_min.s[0].v. That is equivalent to the old hand-computed offset\n\n\toffsetof(struct tcp_sock, rtt_min) + sizeof_field(struct minmax_sample, t)\n\n(s[0] sits at rtt_min + 0 and .v at + sizeof(.t), i.e. what minmax_get()\nreturns), so the loaded field is unchanged and only the full-sock guard is\nadded. The two BUILD_BUG_ON()s that protected the hand-computed offset\nare no longer needed.\n\nBefore patch:\n\n\t0: r1 = *(u64 *)(r1 +0)      ; r1 = skops->sk\n\t1: r1 = *(u32 *)(r1 +2324)   ; ((tcp_sock *)sk)->rtt_min.s[0].v\n\nAfter patch:\n\n\t0: *(u64 *)(r1 +56) = r9\n\t1: r9 = *(u8 *)(r1 +50)      ; is_locked_tcp_sock\n\t2: if r9 == 0 goto pc+4      ; not a locked full sock -> 0\n\t3: r9 = *(u64 *)(r1 +56)\n\t4: r1 = *(u64 *)(r1 +0)      ; r1 = skops->sk\n\t5: r1 = *(u32 *)(r1 +2324)   ; rtt_min.s[0].v\n\t6: goto pc+2\n\t7: r9 = *(u64 *)(r1 +56)\n\t8: r1 = 0","summary":"A BPF sockops program that reads skops->rtt_min can read past a request_sock during connection setup, because the kernel casts it to a full tcp_sock without a check. The read returns adjacent kernel memory, which can include pointer fragments.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","infrastructure","kernel","kubernetes","linux","self-hosted"],"not_affected_if":["default-config","no-sockops-programs"],"how_to_check":"- Check whether the kernel is in a release that includes the fix: unknown\n- List loaded sockops programs with `bpftool prog show` and look for type sock_ops\n- Check whether your environment loads BPF programs at all: `sysctl kernel.unprivileged_bpf_disabled`","fix":"- Update the Linux kernel to a release that includes the upstream commit fixing rtt_min in sock_ops: unknown\n- Until patched, unload sockops BPF programs that read rtt_min if you do not need them","status":"open","published_at":"2026-10-18T16:17:17+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:20:53+00:00","updated_at":"2026-10-25T05:20:53+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:20:53Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit fixing rtt_min in sock_ops: unknown\n- Until patched, unload sockops BPF programs that read rtt_min if you do not need them","reach":"local","title":"Linux kernel BPF sockops: out-of-bounds read leaks kernel memory","impact":"low","summary":"A BPF sockops program that reads skops->rtt_min can read past a request_sock during connection setup, because the kernel casts it to a full tcp_sock without a check. The read returns adjacent kernel memory, which can include pointer fragments.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","bpf","self-hosted","kubernetes"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel memory contents leak to a BPF program, including pointer halves","analyst_note":"Find the affected and fixed kernel versions and whether loading sockops programs needs CAP_BPF or root, from the NVD entry and the upstream kernel commit.","how_to_check":"- Check whether the kernel is in a release that includes the fix: unknown\n- List loaded sockops programs with `bpftool prog show` and look for type sock_ops\n- Check whether your environment loads BPF programs at all: `sysctl kernel.unprivileged_bpf_disabled`","needs_analyst":true,"not_affected_if":["no-sockops-programs","default-config"],"who_is_affected":"Systems running the Linux kernel where a BPF sockops program is attached and reads rtt_min. Hosts without sockops programs loaded are not exposed through this path. Whether unprivileged users can trigger it is unknown from the sources.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000732,"input_tokens":4192,"output_tokens":625,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':355C,409C '+2':425C '+2324':363C,417C '+4':393C '+50':382C '+56':376C,404C,430C '-2026':14A,17A '-98643':15A,18A '0':209C,276C,301C,306C,351C,369C,373C,390C,399C,420C,433C '0xffff8881':181C '1':359C,378C '2':387C '3':400C '4':405C '5':413C '6':422C '7':426C '8':431C 'add':331C 'adjac':61B,144C 'bit':258C 'bound':8A,84C 'bpf':3A,19B,28B,79C,151C,159C 'bug':335C 'build':334C 'case':158C 'cast':48B,124C,192C 'check':57B,100C,202C,244C 'code':239C 'comput':286C,343C 'conn':107C 'connect':43B 'ctx':122C 'current':270C 'cve':13A,16A 'dirti':143C 'end':137C 'equival':280C 'everi':220C 'exact':194C 'field':199C,224C,252C,295C,320C 'fix':80C 'follow':74C 'fragment':68B 'full':52B,119C,130C,218C,327C,397C 'full-sock':326C 'get':198C,251C,315C 'goe':228C 'goto':391C,423C 'guard':190C,329C 'half':184C 'hand':285C,342C 'hand-comput':284C,341C 'high':183C 'host':26B 'i.e':312C 'includ':66B 'infrastructur':20B 'init':163C 'instanc':174C 'int':148C 'kernel':2A,11A,21B,47B,62B,72C,188C 'kubernet':22B 'leak':10A,164C,187C 'linux':1A,23B,71C 'load':319C 'lock':204C,217C,384C,396C 'longer':347C 'memori':12A,63B,145C 'min':35B,88C,98C,134C,167C,180C,232C,247C,255C,271C,293C,305C 'min.s':275C,368C,419C 'minmax':264C,297C,314C 'need':348C 'never':99C 'non':118C 'non-ful':117C 'offset':287C,344C 'offsetof':288C 'old':283C 'one':175C,236C 'oob':172C 'op':91C,111C,153C,157C,161C,197C,212C,227C,250C 'open':238C 'open-cod':237C 'out-of-bound':5A,81C 'pass':273C 'past':38B,135C 'patch':350C,372C 'path':109C 'pc':392C,424C 'pointer':67B,189C 'prog':94C,149C 'program':30B 'protect':339C 'r1':352C,354C,356C,360C,362C,375C,381C,403C,406C,408C,410C,414C,416C,429C,432C 'r9':377C,379C,389C,401C,427C 'read':9A,32B,37B,59B,85C,95C,132C,168C,177C,245C 'request':40B,108C,115C,140C,170C 'resolv':78C 'return':60B,142C,178C,208C,316C 'rewrit':123C 'rtt':34B,87C,97C,133C,166C,179C,231C,246C,254C,274C,292C,304C,367C,418C 'rwnd':162C 'sampl':298C 'sec':146C 'self':25B 'self-host':24B 'setup':44B 'sit':302C 'sizeof':294C,310C 'sk':102C,112C,213C,358C,366C,412C 'skip':242C 'skop':33B,96C,154C,156C,165C,357C,411C 'sock':41B,54B,90C,110C,116C,129C,141C,152C,160C,171C,196C,206C,211C,223C,226C,249C,291C,328C,365C,386C,398C 'socket':219C 'sockop':4A,29B,93C,147C 'special':259C 'struct':150C,263C,289C,296C 'switch':155C 'tcp':53B,106C,128C,205C,222C,290C,364C,385C 'two':333C 'type':103C 'u32':361C,415C 'u64':353C,374C,402C,407C,428C 'u8':380C 'unchang':322C 'v':277C,308C,370C,421C 'vulner':75C 'want':268C 'without':55B","nicknames":[],"mitigations":[],"who_affected":"Systems running the Linux kernel where a BPF sockops program is attached and reads rtt_min. Hosts without sockops programs loaded are not exposed through this path. Whether unprivileged users can trigger it is unknown from the sources.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98643","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98643","severity":null,"published_at":"2026-10-18T16:17:17+00:00","modified_at":"2026-10-19T10:19:28+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}