Live › vulnerability › CVE-2026-98801
Go to dashboardThe Linux kernel let the SO_RESERVE_MEM socket option run on UDP sockets, where its locking is wrong, and accepted huge values that overflow a 32-bit counter. A local or networked process that sets the option can corrupt kernel socket memory accounting.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Affected systems are Linux hosts running a kernel without the fix, most relevant where applications call SO_RESERVE_MEM or handle UDP traffic at scale. The sources do not say which workloads trigger the bug in practice. Systems that have already moved to a patched kernel can skip this.
No product ranges from the sources yet.
uname -r and compare against the kernel release that carries the fix (unknown from these sources)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
net: restrict SO_RESERVE_MEM to TCP sockets and cap max value
Commit 2bb2f5fb21b0 ("net: add new socket option SO_RESERVE_MEM") and commit d00c8ee31729 ("net: fix possible NULL deref in sock_reserve_memory") only checked sk_has_account(sk), which is true for both TCP and UDP sockets.
However, SO_RESERVE_MEM and sk_unused_reserved_mem() are currently only supported by TCP:
Restrict sock_reserve_memory() to TCP sockets (sk_is_tcp(sk)) for now. Supporting SO_RESERVE_MEM for UDP (acquiring sk_receive_queue.lock and honoring sk_unused_reserved_mem() in udp_rmem_release()) can be done in a future net-next series if needed.
In addition, reject val > SZ_1G with -EINVAL in sk_setsockopt(SO_RESERVE_MEM). Without an upper bound, values near INT_MAX cause sk_mem_pages(delta) and (pages << PAGE_SHIFT) to overflow 32-bit signed int, corrupting sk->sk_forward_alloc and sk->sk_reserved_mem. Using a page-aligned cap (SZ_1G) ensures that the page-rounded sk->sk_reserved_mem reported by getsockopt(SO_RESERVE_MEM) can always be passed back to setsockopt(SO_RESERVE_MEM).
This page as .md · .json · in your agent: get_signal("CVE-2026-98801")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.