CVE-2026-98801

Received Received - Intake

SO_RESERVE_MEM Restriction to TCP Sockets in Linux Kernel

Publication date: 2026-10-18

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: restrict SO_RESERVE_MEM to TCP sockets and cap max value Commit 2bb2f5fb21b0 ("net: add new socket option SO_RESERVE_MEM") and commit d00c8ee31729 ("net: fix possible NULL deref in sock_reserve_memory") only checked sk_has_account(sk), which is true for both TCP and UDP sockets. However, SO_RESERVE_MEM and sk_unused_reserved_mem() are currently only supported by TCP: - On UDP sockets, sk->sk_forward_alloc is protected by sk->sk_receive_queue.lock, whereas sock_reserve_memory() and sock_release_reserved_memory() only acquire lock_sock(sk). Concurrent UDP packet reception/release and setsockopt(SO_RESERVE_MEM) corrupt sk_forward_alloc and memcg accounting. - udp_rmem_release() reclaims excess sk_forward_alloc without accounting for sk_unused_reserved_mem(sk). Restrict sock_reserve_memory() to TCP sockets (sk_is_tcp(sk)) for now. Supporting SO_RESERVE_MEM for UDP (acquiring sk_receive_queue.lock and honoring sk_unused_reserved_mem() in udp_rmem_release()) can be done in a future net-next series if needed. In addition, reject val > SZ_1G with -EINVAL in sk_setsockopt(SO_RESERVE_MEM). Without an upper bound, values near INT_MAX cause sk_mem_pages(delta) and (pages << PAGE_SHIFT) to overflow 32-bit signed int, corrupting sk->sk_forward_alloc and sk->sk_reserved_mem. Using a page-aligned cap (SZ_1G) ensures that the page-rounded sk->sk_reserved_mem reported by getsockopt(SO_RESERVE_MEM) can always be passed back to setsockopt(SO_RESERVE_MEM).

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-18

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-18

EPSS Evaluated

N/A

NVD

CVE-2026-98801

EUVD

EUVD-2026-103886

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	2bb2f5fb21b0486ff69b7b4a1fe03a760527d133
Linux	Linux	2bb2f5fb21b0486ff69b7b4a1fe03a760527d133
Linux	Linux	2bb2f5fb21b0486ff69b7b4a1fe03a760527d133
Linux	Linux	2bb2f5fb21b0486ff69b7b4a1fe03a760527d133
Linux	Linux	5.16

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of the SO_RESERVE_MEM socket option. It allows corruption of memory accounting and memcg (memory cgroup) tracking due to concurrent operations on UDP sockets. The issue arises because SO_RESERVE_MEM is only properly supported by TCP sockets, but the checks initially allowed both TCP and UDP sockets. This can lead to memory accounting errors and potential system instability.

Detection Guidance

This vulnerability affects the Linux kernel's handling of the SO_RESERVE_MEM socket option. Detection involves checking for kernel versions affected by the issue and verifying if SO_RESERVE_MEM is enabled on UDP sockets. Use 'uname -r' to check kernel version and 'ss -tuln' to inspect socket options. If SO_RESERVE_MEM is set on UDP sockets, it may indicate potential misuse.

Impact Analysis

This vulnerability can cause memory corruption, leading to system crashes or unpredictable behavior. It may also result in incorrect memory usage reporting, affecting resource management and potentially causing denial-of-service conditions. Systems relying on accurate memory accounting could experience failures.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel networking issue. The flaw involves memory accounting corruption in TCP/UDP sockets, which could lead to resource exhaustion or incorrect memory tracking. However, no evidence suggests direct impacts on data protection or privacy compliance requirements.

Mitigation Strategies

Apply the latest kernel patches that restrict SO_RESERVE_MEM to TCP sockets only. Update to a kernel version containing the fix (commit 2bb2f5fb21b0 or later). Temporarily disable SO_RESERVE_MEM on UDP sockets if not required. Monitor kernel logs for errors related to socket memory accounting.

Hi! I’m here to help you understand CVE-2026-98801. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70