PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-98925 Linux CVE debrief

A vulnerability in the Linux kernel's bpf and sockmap components can cause double-counting of copied sequences when a BPF stream_verdict program redirects an skb back to the same socket. This issue may lead to warnings and incorrect TCP receive message handling. The vulnerability affects Linux kernel versions and may impact Linux distribution vendors and users of Linux-based systems. To address this issue, it is essential to assess exposure and apply patches as needed. The CVE record and source item provide details on the vulnerability, including its description and affected versions.

Vendor
Linux
Product
Unknown
CVSS
Unknown
CISA KEV
Not listed in stored evidence
Original CVE published
2026-10-23
Original CVE updated
2026-10-23
Advisory published
2026-10-23
Advisory updated
2026-10-23

Who should care

Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and apply patches as needed. The vulnerability affects Linux kernel versions and may impact Linux distribution vendors and users of Linux-based systems. It is essential to assess exposure and apply patches as needed to address this issue.

Why it matters

A vulnerability in the Linux kernel's bpf and sockmap components can cause double-counting of copied sequences, leading to warnings and incorrect TCP receive message handling. Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based systems should assess exposure and apply patches as needed.

  • Verify Linux kernel versions to determine exposure.
  • Assess and apply patches from Linux vendors for affected versions.
  • Monitor system logs for warnings related to TCP receive message handling.

Technical summary

The vulnerability is caused by double-counting of copied sequences when a BPF stream_verdict program redirects an skb back to the same socket in the Linux kernel's bpf and sockmap components. This issue may lead to warnings and incorrect TCP receive message handling. The vulnerability affects Linux kernel versions and may impact Linux distribution vendors and users of Linux-based systems. To address this issue, it is essential to assess exposure and apply patches as needed. The CVE record and source item provide details on the vulnerability, including its description and affected versions.

Defensive priority

Verify Linux kernel versions and assess exposure based on used versions and configurations.

Recommended defensive actions

  • Verify Linux kernel versions and assess exposure based on used versions and configurations.
  • Review and apply patches from Linux vendors for affected versions.
  • Monitor system logs for warnings related to TCP receive message handling.
  • Perform thorough vulnerability assessments to identify potential exposure.
  • Implement compensating controls for exposed systems while remediation is scheduled and verified.
  • Track exceptions, retest remediated assets, and close the item only after evidence is documented.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its description and affected versions. However, the CVSS score and severity are not provided. The vulnerability is caused by double-counting of copied sequences when a BPF stream_verdict program redirects an skb back to the same socket in the Linux kernel's bpf and sockmap components. The issue may lead to warnings and incorrect TCP receive message handling. Linux kernel developers and maintainers, Linux distribution vendors, and users of Linux-based The 7

Sources and references

Verified primary and authoritative sources

  • CVE-2026-98925 CVE Program record

    Publisher, destination, and source semantics verified

    URL: https://www.cve.org/CVERecord?id=CVE-2026-98925

    CVE Program - Official CVE Program record with source-provided CVE metadata.

  • CVE-2026-98925 NVD vulnerability detail

    Publisher, destination, and source semantics verified

    URL: https://nvd.nist.gov/vuln/detail/CVE-2026-98925

    NIST National Vulnerability Database - Official NIST NVD detail page and source-specific vulnerability assessment.

Supplemental references

  • bpf, sockmap: Fix self-redirect copied_seq double-counting

    Unverified legacy reference

    URL: https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/98xxx/CVE-2026-98925.json

    cve_program_cvelist_v5

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/cf9aefb26a071cb8b6fdd761c27e022a1184946d

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/dc98def81e3c629e25fcdd5753b1db93aab27ce9

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ef6f2182fee6b9721c005ccfc6aec0a47f79bbfa

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/ae1ffd04e98beefbe5d83335d506b0bcd5c2a6b3

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/88942054191185c6f8bea5568cbb5614d1e99af9

    Supplemental source

  • Source reference

    Unverified legacy reference

    URL: https://git.kernel.org/stable/c/490a83d6386eec1d29f470c8d7331677fb46c3b7

    Supplemental source

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.