{"id":"CVE-2026-98801","kind":"vulnerability","aliases":["CVE-2026-98801"],"related":[],"title":"Linux kernel: SO_RESERVE_MEM misuse on UDP sockets can corrupt memory accounting","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nnet: restrict SO_RESERVE_MEM to TCP sockets and cap max value\n\nCommit 2bb2f5fb21b0 (\"net: add new socket option SO_RESERVE_MEM\") and\ncommit d00c8ee31729 (\"net: fix possible NULL deref in sock_reserve_memory\")\nonly checked sk_has_account(sk), which is true for both TCP and UDP\nsockets.\n\nHowever, SO_RESERVE_MEM and sk_unused_reserved_mem() are currently only\nsupported by TCP:\n- On UDP sockets, sk->sk_forward_alloc is protected by\n  sk->sk_receive_queue.lock, whereas sock_reserve_memory() and\n  sock_release_reserved_memory() only acquire lock_sock(sk). Concurrent\n  UDP packet reception/release and setsockopt(SO_RESERVE_MEM) corrupt\n  sk_forward_alloc and memcg accounting.\n- udp_rmem_release() reclaims excess sk_forward_alloc without\n  accounting for sk_unused_reserved_mem(sk).\n\nRestrict sock_reserve_memory() to TCP sockets (sk_is_tcp(sk)) for now.\nSupporting SO_RESERVE_MEM for UDP (acquiring sk_receive_queue.lock and\nhonoring sk_unused_reserved_mem() in udp_rmem_release()) can be done in\na future net-next series if needed.\n\nIn addition, reject val > SZ_1G with -EINVAL in\nsk_setsockopt(SO_RESERVE_MEM). Without an upper bound, values near\nINT_MAX cause sk_mem_pages(delta) and (pages << PAGE_SHIFT) to overflow\n32-bit signed int, corrupting sk->sk_forward_alloc and\nsk->sk_reserved_mem. Using a page-aligned cap (SZ_1G) ensures that the\npage-rounded sk->sk_reserved_mem reported by getsockopt(SO_RESERVE_MEM)\ncan always be passed back to setsockopt(SO_RESERVE_MEM).","summary":"The Linux kernel let the SO_RESERVE_MEM socket option run on UDP sockets, where its locking is wrong, and accepted huge values that overflow a 32-bit counter. A local or networked process that sets the option can corrupt kernel socket memory accounting.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","kernel","linux","self-hosted"],"not_affected_if":["patched-kernel"],"how_to_check":"- Run `uname -r` and compare against the kernel release that carries the fix (unknown from these sources)\n- Check whether your distribution's kernel changelog lists CVE-2026-98801 (unknown from these sources)","fix":"- Update the Linux kernel to a release that includes the upstream commits restricting SO_RESERVE_MEM to TCP and capping it at SZ_1G (exact version unknown from these sources)\n- Reboot after the kernel update so the fixed kernel is running","status":"open","published_at":"2026-10-18T16:17:34+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","triaged_at":"2026-10-25T05:15:05+00:00","updated_at":"2026-10-25T05:15:05+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-10-25T05:15:05Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commits restricting SO_RESERVE_MEM to TCP and capping it at SZ_1G (exact version unknown from these sources)\n- Reboot after the kernel update so the fixed kernel is running","reach":"unknown","title":"Linux kernel: SO_RESERVE_MEM misuse on UDP sockets can corrupt memory accounting","impact":"medium","summary":"The Linux kernel let the SO_RESERVE_MEM socket option run on UDP sockets, where its locking is wrong, and accepted huge values that overflow a 32-bit counter. A local or networked process that sets the option can corrupt kernel socket memory accounting.","category":"infrastructure","nicknames":[],"who_cares":["linux","kernel","self-hosted"],"confidence":0.5,"needs_auth":"unknown","worst_case":"kernel socket memory accounting corrupted, possibly leading to crashes or escalation","analyst_note":"Find the fixed kernel version numbers and the upstream commit list at https://nvd.nist.gov/vuln/detail/CVE-2026-98801 and the kernel stable mailing list.","how_to_check":"- Run `uname -r` and compare against the kernel release that carries the fix (unknown from these sources)\n- Check whether your distribution's kernel changelog lists CVE-2026-98801 (unknown from these sources)","needs_analyst":true,"not_affected_if":["patched-kernel"],"who_is_affected":"Affected systems are Linux hosts running a kernel without the fix, most relevant where applications call SO_RESERVE_MEM or handle UDP traffic at scale. The sources do not say which workloads trigger the bug in practice. Systems that have already moved to a patched kernel can skip this.","user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.000724,"input_tokens":3959,"output_tokens":657,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-98801':16A,19A '1g':250C,299C '2bb2f5fb21b0':93C '32':52B,278C 'accept':46B 'account':13A,69B,118C,185C,195C 'acquir':166C,221C 'add':95C 'addit':246C 'align':296C 'alloc':150C,182C,193C,286C 'alway':317C 'back':320C 'bit':53B,279C 'bound':262C 'cap':89C,297C 'caus':267C 'check':115C 'commit':92C,103C 'concurr':170C 'corrupt':11A,65B,179C,282C 'counter':54B 'current':139C 'cve':14A,17A 'd00c8ee31729':104C 'delta':271C 'deref':109C 'done':235C 'einval':252C 'ensur':300C 'excess':190C 'fix':106C 'follow':75C 'forward':149C,181C,192C,285C 'futur':238C 'getsockopt':312C 'honor':224C 'host':25B 'howev':129C 'huge':47B 'infrastructur':20B 'int':265C,281C 'kernel':2A,21B,28B,66B,73C 'let':29B 'linux':1A,22B,27B,72C 'local':56B 'lock':42B,167C 'max':90C,266C 'mem':5A,33B,84C,101C,132C,137C,178C,200C,218C,228C,258C,269C,291C,309C,315C,325C 'memcg':184C 'memori':12A,68B,113C,159C,164C,205C 'misus':6A 'near':264C 'need':244C 'net':80C,94C,105C,240C 'net-next':239C 'network':58B 'new':96C 'next':241C 'null':108C 'option':35B,63B,98C 'overflow':50B,277C 'packet':172C 'page':270C,273C,274C,295C,304C 'page-align':294C 'page-round':303C 'pass':319C 'possibl':107C 'process':59B 'protect':152C 'reception/release':173C 'reclaim':189C 'reject':247C 'releas':162C,188C,232C 'report':310C 'reserv':4A,32B,83C,100C,112C,131C,136C,158C,163C,177C,199C,204C,217C,227C,257C,290C,308C,314C,324C 'resolv':79C 'restrict':81C,202C 'rmem':187C,231C 'round':305C 'run':36B 'self':24B 'self-host':23B 'seri':242C 'set':61B 'setsockopt':175C,255C,322C 'shift':275C 'sign':280C 'sk':116C,119C,134C,147C,148C,154C,169C,180C,191C,197C,201C,209C,212C,225C,254C,268C,283C,284C,288C,289C,306C,307C 'sk_receive_queue.lock':155C,222C 'sock':111C,157C,161C,168C,203C 'socket':9A,34B,39B,67B,87C,97C,128C,146C,208C 'support':141C,215C 'sz':249C,298C 'tcp':86C,125C,143C,207C,211C 'true':122C 'udp':8A,38B,127C,145C,171C,186C,220C,230C 'unus':135C,198C,226C 'upper':261C 'use':292C 'val':248C 'valu':48B,91C,263C 'vulner':76C 'wherea':156C 'without':194C,259C 'wrong':44B","nicknames":[],"mitigations":[],"who_affected":"Affected systems are Linux hosts running a kernel without the fix, most relevant where applications call SO_RESERVE_MEM or handle UDP traffic at scale. The sources do not say which workloads trigger the bug in practice. Systems that have already moved to a patched kernel can skip this.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-18T16:17:34+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-98801","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-98801","severity":null,"published_at":"2026-10-18T16:17:34+00:00","modified_at":"2026-10-19T10:19:44+00:00","first_seen_at":"2026-10-23T21:57:16+00:00","fetched_at":"2026-10-23T22:28:56+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}