CVE-2026-98300

A flaw was found in the Linux kernel. A race condition in the Transmission Control Protocol (TCP) IPv6 implementation occurs when an incoming network packet is processed concurrently while a listening socket is being closed. An attacker could exploit this timing window to cause improper memory accounting, potentially resulting in a kernel crash and a Denial of Service (DoS).

A race between IPv6 TCP packet processing and close of a listening socket can change the socket state from TCP_LISTEN to TCP_CLOSE before tcp_v6_do_rcv checks it. This may cause skb_clone_and_charge_r to run without the expected socket locking and leave sk_forward_alloc accounting inconsistent, which is detected as a warning during inet_sock_destruct. Reliable triggering requires an incoming IPv6 TCP packet, enabled receive option processing, control over a listening socket, and a narrow timing window around close. For the CVSS the PR:L reflects that a local user or process normally needs to create and close the listener even though network traffic contributes to the race. The issue is not treated as independently remotely exploitable because a remote sender cannot normally control the required local close operation. The demonstrated impact is limited availability degradation and a kernel warning. A host crash is plausible mainly on systems configured with panic_on_warn, while no UAF, OOB access, information leak, or write primitive is established.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.