---
cve: "CVE-2026-43198"
severity: "CRITICAL"
cvss: 9.8
epss: "0.3%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-05-06 12:16:38"
tags: [cve, security, critical]
source: tsecurity.de CVE-Dossier
exported: "2026-09-20T02:49:54+02:00"
---

# CVE-2026-43198

> 9.8 CRITICAL

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix potential race in tcp_v6_syn_recv_sock()

Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock()
is done too late.

After tcp_v4_syn_recv_sock(), the child socket is already visible
from TCP ehash table and other cpus might use it.

Since newinet->pinet6 is still pointing to the listener ipv6_pinfo
bad things can happen as syzbot found.

Move the problematic code in tcp_v6_mapped_child_init()
and call this new helper from tcp_v4_syn_recv_sock() before
the ehash insertion.

This allows the removal of one tcp_sync_mss(), since
tcp_v4_syn_recv_sock() will call it with the correct
context.

## CVSS-Vektor

```
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Netzwerk | bad |
| AC Komplexität | Gering | bad |
| PR Privilegien | Keine | bad |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Hoch | bad |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- Kernel ≥ 5.10.270
- Kernel ≥ 5.15.221
- Kernel ≥ 6.1.188
- Kernel ≥ 6.6.157
- Kernel ≥ 6.12.110
- Kernel ≥ 6.18.16
- Kernel ≥ 6.19.6

## Referenzen

- <https://git.kernel.org/stable/c/aef4a9ae95d1bc4f7897065011e6261026719aeb>
- <https://git.kernel.org/stable/c/dad1fe7db6c6519138430ac8f5e589c18f83bfc9>
- <https://git.kernel.org/stable/c/a7e761ba55efaa9c49e0afdd304bb78167af3429>
- <https://git.kernel.org/stable/c/cd644e6dc72eec8d9d988717ea1c54f8668ded69>
- <https://git.kernel.org/stable/c/9ed654e340f4c73bc6f0af2fbc90ac293e645ce0>
- <https://git.kernel.org/stable/c/fe89b2f05b854847784f91127319172945c1fadd>
- <https://git.kernel.org/stable/c/7178e2a8027423b2af17ab95df73a749a5b72e5b>
- <https://git.kernel.org/stable/c/858d2a4f67ff69e645a43487ef7ea7f28f06deae>
- <https://access.redhat.com/errata/RHSA-2026:30129>
- <https://access.redhat.com/errata/RHSA-2026:33215>
- <https://access.redhat.com/errata/RHSA-2026:33285>
- <https://access.redhat.com/errata/RHSA-2026:34094>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-43198) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_