CVE-2026-98595

A flaw was found in the Linux kernel's UDP networking subsystem. When a connected User Datagram Protocol (UDP) socket bound to a specific address is disconnected, the kernel fails to remove the socket entry from its internal connection lookup table. A local user can cause stale entries to persist, potentially allowing incoming network packets from former peers to be improperly matched and delivered, or causing degraded network processing performance.

This vulnerability is evaluated with a Low severity impact because exploitation requires local access to establish and tear down UDP connections, resulting at most in minor network processing delays or potential datagram misdelivery without compromising host integrity or confidential data. In addition, the underlying code changes from upstream are not present in enterprise kernels shipping with Red Hat Enterprise Linux. Default enterprise deployments are therefore not exposed to this flaw.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.