CVE-2026-98646 in Linux
Summary
by MITRE • 10/18/2026
In the Linux kernel, the following vulnerability has been resolved:
tcp: Skip cond_resched() in inet_csk_listen_stop() under BPF context
bpf_sock_destroy() runs from the tcp iterator, under rcu_read_lock(). If the sock is a listener that still has children in its accept queue, tcp_abort() ends up in inet_csk_listen_stop() and the cond_resched() there trips the debug check:
BUG: sleeping function called from invalid context at net/ipv4/inet_connection_sock.c:1523 in_atomic(): 0, irqs_disabled(): 0, non_block: 0, pid: 628, name: test_progs preempt_count: 0, expected: 0 RCU nest depth: 1, expected: 0 locks held by test_progs/628: 3, last CPU#3: #0: ffff8881158cee18 (&p->lock){+.+.}-{4:4}, at: bpf_seq_read+0x56/0x1210
#1: ffff8881106bb858 (sk_lock-AF_INET6){+.+.}-{0:0}, at: bpf_iter_tcp_seq_show+0x32b/0x4b0
#2: ffffffffb435af20 (rcu_read_lock){....}-{1:3}, at: bpf_iter_run_prog+0x46b/0xde0
CPU: 3 UID: 0 PID: 628 Comm: test_progs Tainted: G W 7.2.0+ #65 PREEMPT Tainted: [W]=WARN
Call Trace: <TASK> dump_stack_lvl+0xc1/0xf0 dump_stack+0x10/0x20 __might_resched+0x3d2/0x610 inet_csk_listen_stop+0x7b/0xbf0 tcp_abort+0x23b/0x3b0 bpf_sock_destroy+0xfc/0x140 bpf_prog_448133d24601754f_iter_tcp6_server+0x81/0x8a bpf_iter_run_prog+0x538/0xde0 bpf_iter_tcp_seq_show+0x26b/0x4b0 bpf_seq_read+0x424/0x1210 vfs_read+0x197/0xe40 ksys_read+0x119/0x240 __x64_sys_read+0x72/0xc0 x64_sys_call+0x647/0x27e0 do_syscall_64+0xe5/0x610 entry_SYSCALL_64_after_hwframe+0x76/0x7e RIP: 0033:0x7fad39b28aca RSP: 002b:00007ffc381c61c0 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 RAX: ffffffffffffffda RBX: 00007ffc381c6a88 RCX: 00007fad39b28aca RDX: 0000000000000032 RSI: 00007ffc381c6250 RDI: 0000000000000014 RBP: 00007ffc381c61e0 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000003 R13: 0000000000000000 R14: 000055f077c1bbb0 R15: 00007fad3a0f3000 </TASK>
The commit that added the kfunc already guards lock_sock() in tcp_abort() and udp_abort() with has_current_bpf_ctx(), but missed the listener path. Do the same for the cond_resched(). The loop runs inside the iterator's rcu_read_lock(), it must not reschedule or report a quiescent state there.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/18/2026
The Linux kernel contains a concurrency and context violation vulnerability within the TCP stack implementation, specifically involving the interaction between BPF socket iterators and listener socket termination routines. The issue arises when the bpf_sock_destroy function is invoked during the execution of a TCP iterator program under an RCU read lock context. In this specific operational scenario, if the targeted socket is a listening socket that still has pending child connections in its accept queue, the kernel attempts to abort these sockets via tcp_abort(). This call chain eventually leads to inet_csk_listen_stop(), which contains a cond_resched() invocation intended to allow for preemption and scheduling of other tasks. However, executing cond_resched() while holding an RCU read lock is strictly prohibited in Linux kernel programming because it can trigger a sleeping function called from invalid context bug check. This debug assertion fails because the current execution context does not permit rescheduling or reporting quiescent states, leading to a kernel warning and potential instability if left unaddressed.
From a technical perspective, this flaw represents an improper synchronization mechanism where a scheduling point is introduced in a non-preemptible atomic-like context defined by RCU protection. The vulnerability stems from incomplete guard logic added in previous commits that protected lock_sock() calls within tcp_abort() and udp_abort() using the has_current_bpf_ctx() check to bypass locking when running under BPF contexts, but failed to apply similar protections to the cond_resched() call inside inet_csk_listen_stop(). Consequently, when a BPF program iterates over TCP sockets and triggers destruction of listener sockets with active children, the kernel attempts to yield control back to the scheduler while still within an RCU critical section. This violates fundamental kernel concurrency rules that mandate no sleeping or rescheduling operations occur under RCU read-side critical sections to prevent race conditions and deadlocks related to grace period tracking.
The operational impact of this vulnerability includes immediate kernel warnings, which can clutter system logs and obscure other issues during debugging efforts. More critically, depending on the specific kernel configuration and timing, such violations can lead to unpredictable behavior including potential hangs or crashes if the scheduler attempts operations that assume a valid preemptible context while RCU state is inconsistent. This affects systems utilizing eBPF for network monitoring, security policy enforcement, or traffic analysis where socket iteration is common. The presence of this bug undermines system reliability and stability in environments heavily reliant on dynamic kernel tracing and BPF-based observability tools.
To mitigate this vulnerability, the recommended action is to apply the upstream Linux kernel patch that modifies inet_csk_listen_stop() to skip cond_resched() when executed within a BPF context. This aligns with existing patterns where lock acquisition functions are guarded against rescheduling in atomic contexts. Administrators should ensure their systems are updated to include this fix, which typically involves updating the linux-image package or applying specific kernel patches depending on the distribution's release cycle. For organizations unable to immediately patch production kernels, mitigating exposure by restricting BPF programs that perform socket iteration over listener sockets with pending connections can reduce risk until a full update is deployed.
This vulnerability maps to CWE-754: Improper Check for Unusual or Exceptional Conditions in the context of missing contextual checks before scheduling operations. It also relates to CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization, as it involves incorrect handling of shared kernel data structures under conflicting execution constraints. In terms of MITRE ATT&CK, this is not directly exploitable by an external attacker for privilege escalation or remote code execution in a typical scenario but falls under T1059: Command and Scripting Interpreter if leveraged through malicious BPF programs to disrupt system stability as part of a denial-of-service campaign. The fix ensures that the kernel correctly identifies when it is running inside a restricted context like RCU read lock held by BPF code, thereby preventing illegal scheduling attempts that compromise internal consistency guarantees.