CVE-2026-98276: UDP socket race condition in Linux kernel

UDP socket race condition (CVE-2026-98276): local use-after-free with CVSS 7.8 (High) for LPE.

CVE-2026-98276 is a race condition in the Linux kernel that affects UDP socket management. The vulnerability resides in sock_gettstamp(), which modifies socket flags without lock protection. This enables two threads to simultaneously modify the same bit: bind() sets SOCK_RCU_FREE while SIOCGSTAMPNS_NEW sets SOCK_TIMESTAMP. Loss of SOCK_RCU_FREE causes a use-after-free in the UDP receive path.

The vulnerability is rated CVSS 7.8 (High) and represents a serious risk for multi-user Linux systems. Jungwoo Lee and Wongi Lee documented the bug via a proof-of-concept exploit demonstrating the use-after-free in test environments. Current status is resolved: a patch was incorporated into the kernel, with the fix limiting socket lock acquisition to only when SOCK_TIMESTAMP must be set.

For IT teams and sysadmin: immediately update the Linux kernel to patched versions. Verify systems in use via kernel version check (uname -r). Monitor logs for anomalous UDP socket patterns in bind() on potentially compromised systems. Implement ASLR and execshield as additional mitigations against local exploitation. On unpatched systems, restrict privileges of untrusted users to reduce attack surface.

At a glance

What: Use-after-free in UDP sockets caused by race condition between bind() and SIOCGSTAMPNS_NEW ioctl. The flaw enables loss of the SOCK_RCU_FREE flag, causing the kernel to immediately free the socket without waiting for RCU grace period, while the UDP receive path still holds a reference-less pointer.
Severity: CVSS 7.8 (High). Enables local privilege escalation: unprivileged attackers exploit the race condition to cause use-after-free in kernel and gain elevated privileges.
Affected versions: Not reported in official data. Context suggests recent kernels (patch in 6.12.95+), but exact affected versions are not declared in NVD.
Fix: Acquire socket lock in sock_gettstamp() only when SOCK_TIMESTAMP must be set. Keeps the common path lock-free, eliminates the race condition, and preserves shared flags. Separate audit recommended for sk_set_memalloc() and sk_clear_memalloc().
Status: Resolved. A patch was developed and incorporated into the official Linux kernel.
Action: Update the Linux kernel to patched versions. Verify local version with 'uname -r'. Monitor logs for exploitation signs (KASAN messages, use-after-free UDP). Restrict privileges on unpatched systems. Implement ASLR and execshield as additional mitigations against local LPE.

Sources: NVD, CVE-2026-98276

← All articles