CVE-2026-43198

After calling tcp_v4_syn_recv_sock(), the newly created child socket is immediately visible in the TCP ehash table and can be used by other processors (CPUs). The problem is that the newinet->pinet6 field still points to the ipv6_pinfo structure of the listening socket, instead of the properly initialized child socket structure. The code initializing this field was executed too late — after other threads could access the socket. The fix moves the problematic code to a new helper function tcp_v6_mapped_child_init(), called by tcp_v4_syn_recv_sock() before inserting the socket into the ehash table.

An attacker or race condition may lead to kernel memory corruption, which in turn may result in data disclosure, unauthorized modification of system state, or its unavailability (crash).

Patches available from the vendor should be applied according to references: commits 7178e2a8, 858d2a4f, and fe89b2f0 in the Linux kernel stable repository (git.kernel.org).

Linux kernel — versions indicated in vendor references (patches available in the stable kernel.org repository).