CVE-2026-43198 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability, as it can be exploited remotely. Affected systems include those running Linux kernel versions from 2.6.12.1 to 6.18.16, 6.19 to 6.19.6, and certain versions of Red Hat Enterprise Linux.

Technical summary

The vulnerability is caused by a race condition in the tcp_v6_syn_recv_sock() function. The function calls tcp_v4_syn_recv_sock(), which makes the child socket visible from the TCP ehash table. However, the initialization of the child socket is not complete at this point, leading to potential exploitation. The fix involves moving the problematic code to a new helper function, tcp_v6_mapped_child_init(), which is called before the ehash insertion. This ensures that the child socket is fully initialized before it is made visible.

Defensive priority

High priority should be given to patching affected systems, as this vulnerability can be exploited remotely. Linux kernel users and administrators should review their systems and apply patches as soon as possible.

Recommended defensive actions

• Apply patches from Linux kernel maintainers
• Review and update Linux kernel versions to ensure affected versions are patched
• Monitor system logs for potential exploitation attempts
• Implement compensating controls, such as network segmentation and access controls
• Perform regular vulnerability scans and risk assessments

Evidence notes

The vulnerability was discovered and reported by syzbot. The fix was provided by Linux kernel maintainers and is available in the stable kernel releases. Red Hat has also provided errata and patches for affected versions of Red Hat Enterprise Linux.

Official resources