CVE-2026-98643

A flaw was found in the Linux kernel's BPF (Berkeley Packet Filter) subsystem. This flaw can lead to information disclosure when a BPF socket operations program reads the round-trip time (rtt_min) field during TCP connection handling. Because the kernel fails to verify the socket type before casting it to a full socket structure, it performs an out-of-bounds read beyond the bounds of the smaller request socket. A local attacker with permission to run BPF programs can exploit this vulnerability to leak sensitive kernel memory.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.