{"id":"CVE-2026-98646","kind":"vulnerability","aliases":["CVE-2026-98646"],"related":[],"title":"Linux kernel: TCP listener teardown under BPF iterator triggers a sleep-in-atomic warning","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context\n\nbpf_sock_destroy() runs from the tcp iterator, under rcu_read_lock(). If\nthe sock is a listener that still has children in its accept queue,\ntcp_abort() ends up in inet_csk_listen_stop() and the cond_resched()\nthere trips the debug check:\n\nBUG: sleeping function called from invalid context at net/ipv4/inet_connection_sock.c:1523\nin_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 628, name: test_progs\npreempt_count: 0, expected: 0\nRCU nest depth: 1, expected: 0\nlocks held by test_progs/628: 3, last CPU#3:\n #0: ffff8881158cee18 (&p->lock){+.+.}-{4:4}, at: bpf_seq_read+0x56/0x1210\n #1: ffff8881106bb858 (sk_lock-AF_INET6){+.+.}-{0:0}, at: bpf_iter_tcp_seq_show+0x32b/0x4b0\n #2: ffffffffb435af20 (rcu_read_lock){....}-{1:3}, at: bpf_iter_run_prog+0x46b/0xde0\nCPU: 3 UID: 0 PID: 628 Comm: test_progs Tainted: G        W           7.2.0+ #65 PREEMPT\nTainted: [W]=WARN\nCall Trace:\n <TASK>\n dump_stack_lvl+0xc1/0xf0\n dump_stack+0x10/0x20\n __might_resched+0x3d2/0x610\n inet_csk_listen_stop+0x7b/0xbf0\n tcp_abort+0x23b/0x3b0\n bpf_sock_destroy+0xfc/0x140\n bpf_prog_448133d24601754f_iter_tcp6_server+0x81/0x8a\n bpf_iter_run_prog+0x538/0xde0\n bpf_iter_tcp_seq_show+0x26b/0x4b0\n bpf_seq_read+0x424/0x1210\n vfs_read+0x197/0xe40\n ksys_read+0x119/0x240\n __x64_sys_read+0x72/0xc0\n x64_sys_call+0x647/0x27e0\n do_syscall_64+0xe5/0x610\n entry_SYSCALL_64_after_hwframe+0x76/0x7e\nRIP: 0033:0x7fad39b28aca\nRSP: 002b:00007ffc381c61c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000\nRAX: ffffffffffffffda RBX: 00007ffc381c6a88 RCX: 00007fad39b28aca\nRDX: 0000000000000032 RSI: 00007ffc381c6250 RDI: 0000000000000014\nRBP: 00007ffc381c61e0 R08: 0000000000000000 R09: 0000000000000000\nR10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003\nR13: 0000000000000000 R14: 000055f077c1bbb0 R15: 00007fad3a0f3000\n </TASK>\n\nThe commit that added the kfunc already guards lock_sock() in tcp_abort()\nand udp_abort() with has_current_bpf_ctx(), but missed the listener path.\nDo the same for the cond_resched(). The loop runs inside the iterator's\nrcu_read_lock(), it must not reschedule or report a quiescent state there.","summary":"When a BPF program destroys a listening TCP socket that still has queued children, the kernel calls cond_resched() while holding an RCU read lock, which trips a kernel debug check. The sources describe a kernel warning and a fix that skips the reschedule in BPF context; they do not describe code execution or data exposure.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["bpf","infrastructure","linux-kernel","tcp"],"not_affected_if":[],"how_to_check":null,"fix":null,"status":"open","published_at":"2026-10-18T16:17:17+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:20:48+00:00","updated_at":"2026-10-25T05:20:48+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:20:48Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"local","title":"Linux kernel: TCP listener teardown under BPF iterator triggers a sleep-in-atomic warning","impact":"low","summary":"When a BPF program destroys a listening TCP socket that still has queued children, the kernel calls cond_resched() while holding an RCU read lock, which trips a kernel debug check. The sources describe a kernel warning and a fix that skips the reschedule in BPF context; they do not describe code execution or data exposure.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","bpf","tcp"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel debug warning; attacker impact not stated in sources","analyst_note":"Check the NVD entry and the upstream kernel commit for the affected version range, the CVSS score, and whether a non-debug kernel is impacted beyond the warning.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":[],"who_is_affected":"unknown","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000645,"input_tokens":4468,"output_tokens":396,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':204C,221C,235C,260C,264C,268C,274C,278C,283C,291C,297C,304C,309C,313C,317C,322C,327C,332C,339C '-2026':17A,20A '-98646':18A,21A '0':162C,165C,168C,176C,178C,184C,194C,213C,214C,240C '0000000000000000':351C,367C,369C,371C,377C '0000000000000003':375C '0000000000000014':363C '0000000000000032':359C '0000000000000246':373C '00000246':348C '000055f077c1bbb0':379C '00007fad39b28aca':357C '00007fad3a0f3000':381C '00007ffc381c61c0':346C '00007ffc381c61e0':365C '00007ffc381c6250':361C '00007ffc381c6a88':355C '002b':345C '0033':342C '0x7fad39b28aca':343C '1':182C,206C,228C '1523':159C '2':223C '3':190C,193C,229C,238C '4':198C,199C '448133d24601754f':287C '628':170C,242C '64':331C,336C '65':250C '7.2.0':249C 'abort':133C,277C,394C,397C 'accept':130C 'add':385C 'af':211C 'alreadi':388C 'atom':14A,161C 'block':167C 'bpf':7A,22B,30B,73B,104C,106C,201C,216C,231C,280C,285C,293C,299C,306C,401C 'bug':150C 'call':44B,153C,255C,326C 'check':58B,149C 'children':41B,127C 'code':79B 'comm':243C 'commit':383C 'cond':45B,96C,143C,413C 'context':74B,105C,156C 'count':175C 'cpu':192C,237C 'csk':100C,138C,271C 'ctx':402C 'current':400C 'cve':16A,19A 'data':82B 'debug':57B,148C 'depth':181C 'describ':61B,78B 'destroy':32B,108C,282C 'disabl':164C 'dump':257C,262C 'eflag':347C 'end':134C 'entri':334C 'execut':80B 'expect':177C,183C 'exposur':83B 'ffff8881106bb858':207C 'ffff8881158cee18':195C 'ffffffffb435af20':224C 'ffffffffffffffda':353C 'fix':67B 'follow':89C 'function':152C 'g':247C 'guard':389C 'held':186C 'hold':48B 'hwframe':338C 'inet':99C,137C,270C 'inet6':212C 'infrastructur':23B 'insid':418C 'invalid':155C 'irq':163C 'iter':8A,113C,217C,232C,288C,294C,300C,420C 'kernel':2A,26B,43B,56B,63B,87C 'kfunc':387C 'ksys':315C 'last':191C 'linux':1A,25B,86C 'linux-kernel':24B 'listen':4A,34B,101C,123C,139C,272C,406C 'lock':52B,117C,185C,197C,210C,227C,390C,424C 'lock-af':209C 'loop':416C 'lvl':259C 'might':266C 'miss':404C 'must':426C 'name':171C 'nest':180C 'net/ipv4/inet_connection_sock.c':158C 'non':166C 'orig':349C 'p':196C 'path':407C 'pid':169C,241C 'preempt':174C,251C 'prog':173C,234C,245C,286C,296C 'program':31B 'progs/628':189C 'queu':40B 'queue':131C 'quiescent':432C 'r08':366C 'r09':368C 'r10':370C 'r11':372C 'r12':374C 'r13':376C 'r14':378C 'r15':380C 'rax':350C,352C 'rbp':364C 'rbx':354C 'rcu':50B,115C,179C,225C,422C 'rcx':356C 'rdi':362C 'rdx':358C 'read':51B,116C,203C,226C,308C,312C,316C,321C,423C 'report':430C 'resch':46B,97C,144C,267C,414C 'reschedul':71B,428C 'resolv':93C 'rip':341C 'rsi':360C 'rsp':344C 'run':109C,233C,295C,417C 'seq':202C,219C,302C,307C 'server':290C 'show':220C,303C 'sk':208C 'skip':69B,95C 'sleep':12A,151C 'sleep-in-atom':11A 'sock':107C,120C,281C,391C 'socket':36B 'sourc':60B 'stack':258C,263C 'state':433C 'still':38B,125C 'stop':102C,140C,273C 'sys':320C,325C 'syscal':330C,335C 'taint':246C,252C 'tcp':3A,27B,35B,94C,112C,132C,218C,276C,301C,393C 'tcp6':289C 'teardown':5A 'test':172C,188C,244C 'trace':256C 'trigger':9A 'trip':54B,146C 'udp':396C 'uid':239C 'vfs':311C 'vulner':90C 'w':248C,253C 'warn':15A,64B,254C 'x10/0x20':265C 'x119/0x240':318C 'x197/0xe40':314C 'x23b/0x3b0':279C 'x26b/0x4b0':305C 'x32b/0x4b0':222C 'x3d2/0x610':269C 'x424/0x1210':310C 'x46b/0xde0':236C 'x538/0xde0':298C 'x56/0x1210':205C 'x64':319C,324C 'x647/0x27e0':328C 'x72/0xc0':323C 'x76/0x7e':340C 'x7b/0xbf0':275C 'x81/0x8a':292C 'xc1/0xf0':261C 'xe5/0x610':333C 'xfc/0x140':284C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:17+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98646","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98646","severity":null,"published_at":"2026-10-18T16:17:17+00:00","modified_at":"2026-10-19T10:19:28+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}