Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-98503— packet: use ubuf_info completion for TX_RING packets

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： packet 子系统：为 TX_RING 数据包使用 ubuf_info 完成机制函数发送的套接字缓冲区（skb）中，其分片（frags）指向环形缓冲区（ring）中的槽位（slots）。这些槽位仅在调用时才会被释放。然而，会在 skb 被真正释放之前调用。这可能导致槽位在仍与 skb 关联的情况下被提前重用，从而引发数据竞争或内存安全问题。修复方案如下：改用标准的零拷贝完成机制（ubuf_info），确保槽位仅在所有对负载（payload）的引用被释放或

AI Predicted 7.8 Difficulty: Hard EPSS 0.20% · P10 Updated Oct 19, 2026

Possible ATT&CK Techniques 3 AI

T1069.004 T1548.001 · Setuid and Setgid T1190 · Exploit Public-Facing Application

Affected Version Matrix 14

Vendor	Product	Version Range	Status
Linux	Linux	`5cd8d46ea1562be80063f53c7c6a5f40224de623< e67c455d79fbf709a94965f09a2be6bf4f4ba5fd`	affected
		`5cd8d46ea1562be80063f53c7c6a5f40224de623< eda9bcb721f15a93746a99eabda33d80b86404fd`	affected
		`5cd8d46ea1562be80063f53c7c6a5f40224de623< 2a0c9afefc0ecea2cc30ccfbbbc98182a0986191`	affected
		`5cd8d46ea1562be80063f53c7c6a5f40224de623< 9518405613863d0bf0700927a21367f5942cf058`	affected
		`67f6fba765ef8cb19089d476e3c367212a2fbdfd`	affected
		`f2a67e68dbaeae7c88e5522873d7b908911f9f77`	affected
		`4.14.86< 4.15`	affected
		`4.19.7< 4.20`	affected
… +6 more rows

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

packet: use ubuf_info completion for TX_RING packets

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: packet: use ubuf_info completion for TX_RING packets tpacket_snd sends skbs with frags pointing into its ring slots. Slots are released when skb->destructor is called. A call to skb_orphan calls skb->destructor before the skb is freed. This can cause the slot to be reused while still linked into the skb. Switch to standard zerocopy completion (ubuf_info) so the slot is only released once all references to the payload are freed or copied. Restore skb->destructor to standard sock_wfree. The ubuf_info completion callback can be called with a NULL skb, but only from net_zcopy_put and related API, used by zerocopy implementations that hold their own reference on the uarg, such as MSG_ZEROCOPY. This uarg is only ever completed from skb_zcopy_clear, so skb is always set. To prevent userspace from aliasing in-flight state on shared ring slots, allocate tpacket_uarg per packet, rather than per slot. This adds a small allocation to the transmit path. Use standard kmalloc to allow backporting to stable kernels. The uarg holds an sk_wmem_alloc reference, rather than an sk_refcnt reference. packet_free_tx_ring waits on sk_wmem_alloc before freeing the ring pages. Always allocate vec->deferred for tx_ring so page-backed rings also wait on sk_wmem_alloc when skb_copy_ubufs drops page refs before calling tpacket_ubuf_complete. Drop the tx_ring.pg_vec test that tpacket_destruct_skb performed before accessing the slot. The sk_wmem_alloc reference now guarantees that the slot is valid. The test is also not sufficient by itself, as it reads pg_vec without pg_vec_lock, so it can race with packet_set_ring. As a result a slot is released when its payload is copied, which can be before transmission (e.g., in skb_orphan_frags_rx). If copied before skb_tx_timestamp() is called, no slot timestamp is recorded, similar to when skb_orphan() was called early in the datapath before this patch. Revert the now unused previous skb_zcopy_.._nouarg infra. Depends on commit 992cc9f94ca9 ("net/packet: defer vmalloc TX_RING free until skbs finish").

Source: CVE Program / CVE List V5

CVSS Information

N/A

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	5cd8d46ea1562be80063f53c7c6a5f40224de623 ~ e67c455d79fbf709a94965f09a2be6bf4f4ba5fd	-
Linux	Linux	4.20	-

II. Public POCs for CVE-2026-98503

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-98503

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-98503 (4)

https://www.cve.org/CVERecord?id=CVE-2026-98503

Same Patch Batch · Linux · 2026-10-18 · 435 CVEs total

CVE-2026-98490	9.8 CRITICAL	net: openvswitch: conntrack: fix helper UAF due to extensions realloc
CVE-2026-98548	9.8 CRITICAL	sctp: discard the rest of the packet on a stale-cookie error
CVE-2026-98464	9.3 CRITICAL	RISC-V: KVM: Synchronize hrtimer callback during teardown
CVE-2026-98549	9.1 CRITICAL	tcp: prevent collapsing skbs across boundary in rtx queue
CVE-2026-98451	8.8 HIGH	smb: client: use finish_no_open() for non-regular inodes
CVE-2026-98466	8.2 HIGH	KVM: arm64: Transfer the hyp stack pages out of the host stage-2
CVE-2026-98499	8.1 HIGH	HID: wacom: fix OOB read in wacom_wac_pen_serial_enforce()
CVE-2026-98454	8.1 HIGH	smb: client: fix create context out-of-bounds reads
CVE-2026-98532	8.1 HIGH	ipv6: do not let ipv6_find_hdr() return an offset past the packet end
CVE-2026-98491	7.8 HIGH	net: openvswitch: conntrack: avoid modifying shared unconfirmed ct entry
CVE-2026-98524	7.8 HIGH	rds: ib: Clear the sg list when mapping an MR fails
CVE-2026-98487	7.8 HIGH	net: bridge: mdb: restart port group walk after deletion
CVE-2026-98520	7.8 HIGH	drm/amdkfd: fix use-after-free and multi-container gap in kfd_dev_mapping
CVE-2026-98517	7.8 HIGH	drm/nouveau/uvmm: fix UAF in nouveau_uvmm_sm when BO is in TTM_PL_SYSTEM
CVE-2026-98436	7.8 HIGH	accel/amdxdna: Disable device buffer exporting
CVE-2026-98515	7.8 HIGH	drm/nouveau: fix double-free in nvif_vmm_dtor
CVE-2026-98510	7.8 HIGH	drm/xe/vm: nuke PTs only after unlinking contested VMAs
CVE-2026-98441	7.8 HIGH	net/sched: act_ct: avoid modifying shared unconfirmed ct entry
CVE-2026-98442	7.8 HIGH	net/sched: act_ct: fix helper UAF due to extensions realloc
CVE-2026-98507	7.8 HIGH	mm/rmap: fix missing barrier between anon_vma init and vma->anon_vma publish

Showing top 20 of 435 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux