PT-2026-116862 · Linux · Linux

CVE-2026-98643

·

Publicado

2026-10-18

·

Atualizado

2026-10-18

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
bpf: Fix out-of-bounds read of rtt min in sock ops
A sockops prog reading skops->rtt min never checks the sk type: on the tcp conn request() path sock ops->sk is a request sock (non-full), and the ctx rewrite casts it to a tcp sock (full) and reads rtt min past the end of the request sock, returning dirty adjacent memory.
SEC("sockops")
int prog(struct bpf sock ops *skops)
{
	switch (skops->op) {
	case BPF SOCK OPS RWND INIT:
		leak = skops->rtt min;  /* reads the request sock OOB */
	...
	}
}
For instance one such read returned rtt min=0xffff8881, the high half of a leaked kernel pointer.
Guarding that cast is exactly what SOCK OPS GET FIELD() does -- it checks is locked tcp sock and returns 0 when sock ops->sk is not a locked full socket. Every other tcp sock field in sock ops goes through it; rtt min is the only one open-coded, so it skips the check.
Read rtt min through SOCK OPS GET FIELD() too. rtt min is a bit special: it is a struct minmax and we only want the current min, so pass rtt min.s[0].v. That is equivalent to the old hand-computed offset
offsetof(struct tcp sock, rtt min) + sizeof field(struct minmax sample, t)
(s[0] sits at rtt min + 0 and .v at + sizeof(.t), i.e. what minmax get() returns), so the loaded field is unchanged and only the full-sock guard is added. The two BUILD BUG ON()s that protected the hand-computed offset are no longer needed.
Before patch:
0: r1 = *(u64 *)(r1 +0)   ; r1 = skops->sk
1: r1 = *(u32 *)(r1 +2324)  ; ((tcp sock *)sk)->rtt min.s[0].v
After patch:
0: *(u64 *)(r1 +56) = r9
1: r9 = *(u8 *)(r1 +50)   ; is locked tcp sock
2: if r9 == 0 goto pc+4   ; not a locked full sock -> 0
3: r9 = *(u64 *)(r1 +56)
4: r1 = *(u64 *)(r1 +0)   ; r1 = skops->sk
5: r1 = *(u32 *)(r1 +2324)  ; rtt min.s[0].v
6: goto pc+2
7: r9 = *(u64 *)(r1 +56)
8: r1 = 0
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-98643

Produtos afetados

Linux