CVE-2026-98503 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
packet: use ubuf_info completion for TX_RING packets
tpacket_snd sends skbs with frags pointing into its ring slots. Slots are released when skb->destructor is called.
A call to skb_orphan calls skb->destructor before the skb is freed. This can cause the slot to be reused while still linked into the skb.
Switch to standard zerocopy completion (ubuf_info) so the slot is only released once all references to the payload are freed or copied. Restore skb->destructor to standard sock_wfree.
The ubuf_info completion callback can be called with a NULL skb, but only from net_zcopy_put and related API, used by zerocopy implementations that hold their own reference on the uarg, such as MSG_ZEROCOPY. This uarg is only ever completed from skb_zcopy_clear, so skb is always set.
To prevent userspace from aliasing in-flight state on shared ring slots, allocate tpacket_uarg per packet, rather than per slot. This adds a small allocation to the transmit path. Use standard kmalloc to allow backporting to stable kernels.
The uarg holds an sk_wmem_alloc reference, rather than an sk_refcnt reference. packet_free_tx_ring waits on sk_wmem_alloc before freeing the ring pages. Always allocate vec->deferred for tx_ring so page-backed rings also wait on sk_wmem_alloc when skb_copy_ubufs drops page refs before calling tpacket_ubuf_complete.
Drop the tx_ring.pg_vec test that tpacket_destruct_skb performed before accessing the slot. The sk_wmem_alloc reference now guarantees that the slot is valid. The test is also not sufficient by itself, as it reads pg_vec without pg_vec_lock, so it can race with packet_set_ring.
As a result a slot is released when its payload is copied, which can be before transmission (e.g., in skb_orphan_frags_rx). If copied before skb_tx_timestamp() is called, no slot timestamp is recorded, similar to when skb_orphan() was called early in the datapath before this patch.
Revert the now unused previous skb_zcopy_.._nouarg infra.
Depends on commit 992cc9f94ca9 ("net/packet: defer vmalloc TX_RING free until skbs finish").
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel packet socket implementation contained a critical race condition in the transmit ring buffer handling mechanism, specifically within the tpacket_snd function. This vulnerability arises from how memory slots are managed when sending packets with fragments that point into shared ring slots. Under normal operation, these slots are intended to be released only after the associated sk_buff destructor is invoked upon freeing the packet data. However, certain code paths, such as those triggered by skb_orphan or its fragment-specific variant skb_orphan_frags_rx, invoke the destructor prematurely before the socket buffer is fully freed. This premature invocation causes ring slot reuse while references to that same memory are still active within the sk_buff structure. Such a scenario creates a use-after-free condition where userspace applications may access stale or overwritten data in shared ring slots, leading to potential information disclosure or system instability due to aliasing of in-flight state on reused memory regions.
To resolve this issue, the kernel developers replaced the custom slot release logic with standard zerocopy completion mechanisms utilizing ubuf_info structures. This architectural shift ensures that a ring slot is only released after all references to its payload have been either copied or explicitly freed by the network stack. The implementation allocates tpacket_uarg per packet rather than per slot, which introduces a minor allocation overhead in the transmit path but guarantees strict isolation of state between concurrent operations. By holding an sk_wmem_alloc reference instead of relying on sk_refcnt, the system ensures that page-backed rings properly wait for all pending operations to complete before freeing ring pages. This change also necessitates always allocating vec->deferred for tx_ring configurations so that even when skb_copy_ubufs drops page references early in the process, the system correctly waits on sk_wmem_alloc via tpacket_ubuf_complete.
The operational impact of this vulnerability extends beyond simple memory corruption risks to include subtle data integrity issues and timestamping inaccuracies. Because slots can now be released before transmission completes if copies occur prior to skb_tx_timestamp calls, no slot timestamp is recorded in these specific edge cases. This behavior mirrors the race conditions present when skb_orphan was called early in previous datapath implementations, potentially affecting applications that rely on precise hardware or software timestamps for network performance monitoring and forensic analysis. The fix also involves reverting unused infrastructure related to skb_zcopy operations without uarg references and removing a redundant test for tx_ring.pg_vec that previously suffered from race conditions due to missing lock protection during access.
From a security classification perspective, this vulnerability aligns with CWE-416 Use After Free, as the core issue is the premature release of memory resources while they are still referenced by active data structures. It also relates to CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization, given that the race condition occurs between kernel threads and userspace processes accessing shared ring buffers without adequate synchronization primitives in the original code path. In terms of MITRE ATT&CK mapping, this falls under T1059 Command and Scripting Interpreter if exploited for arbitrary code execution via memory corruption, or more broadly under Defense Evasion techniques that involve manipulating system resources to hide malicious activity through corrupted state. Mitigation strategies primarily rely on applying the upstream kernel patch which enforces proper reference counting and zerocopy completion semantics. System administrators should ensure their Linux kernels are updated to versions containing this fix, particularly for systems utilizing packet sockets with zero-copy transmission features or high-throughput network applications that depend on ring buffer integrity.