{
  "schemaVersion": 1,
  "attribution": [
    {
      "source": "CISA Known Exploited Vulnerabilities",
      "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog",
      "licence": "US government work"
    },
    {
      "source": "GitHub Advisory Database",
      "url": "https://github.com/advisories",
      "licence": "CC BY 4.0"
    },
    {
      "source": "Have I Been Pwned",
      "url": "https://haveibeenpwned.com/",
      "licence": "CC BY 4.0"
    },
    {
      "source": "CVE Program (CVE records)",
      "url": "https://www.cve.org/Legal/TermsOfUse",
      "licence": "CVE Terms of Use",
      "notice": "Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation.",
      "terms": "CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy."
    },
    {
      "source": "FIRST EPSS",
      "url": "https://www.first.org/epss/",
      "licence": "free to use; FIRST requests attribution"
    }
  ],
  "record": {
    "id": "CVE-2026-98503",
    "sourceURL": "https://www.cve.org/CVERecord?id=CVE-2026-98503",
    "idYear": 2026,
    "status": "PUBLISHED",
    "publishedAt": "2026-10-18T15:17:03.904Z",
    "updatedAt": "2026-10-19T09:20:42.115Z",
    "importedAt": "2026-10-24T01:58:41.756Z",
    "snapshot": {
      "id": "cve_2026-10-24_midnight_baseline",
      "at": "2026-10-24T00:00:00.000Z",
      "source": "https://github.com/CVEProject/cvelistV5/releases/tag/cve_2026-10-24_0100Z"
    },
    "facts": {
      "title": "packet: use ubuf_info completion for TX_RING packets",
      "summary": "In the Linux kernel, the following vulnerability has been resolved:\n\npacket: use ubuf_info completion for TX_RING packets\n\ntpacket_snd sends skbs with frags pointing into its ring slots. Slots\nare released when skb->destructor is called.\n\nA call to skb_orphan calls skb->destructor before the skb is freed.\nThis can cause the slot to be reused while still linked into the skb.\n\nSwitch to standard zerocopy completion (ubuf_info) so the slot is only\nreleased once all references to the payload are freed or copied.\nRestore skb->destructor to standard sock_wfree.\n\nThe ubuf_info completion callback can be called with a NULL skb, but\nonly from net_zcopy_put and related API, used by zerocopy implementations\nthat hold their own reference on the uarg, such as MSG_ZEROCOPY. This\nuarg is only ever completed from skb_zcopy_clear, so skb is always set.\n\nTo prevent userspace from aliasing in-flight state on shared ring\nslots, allocate tpacket_uarg per packet, rather than per slot. This\nadds a small allocation to the transmit path. Use standard kmalloc to\nallow backporting to stable kernels.\n\nThe uarg holds an sk_wmem_alloc reference, rather than an sk_refcnt\nreference. packet_free_tx_ring waits on sk_wmem_alloc before freeing\nthe ring pages. Always allocate vec->deferred for tx_ring so page-backed\nrings also wait on sk_wmem_alloc when skb_copy_ubufs drops page refs\nbefore calling tpacket_ubuf_complete.\n\nDrop the tx_ring.pg_vec test that tpacket_destruct_skb performed before\naccessing the slot. The sk_wmem_alloc reference now guarantees that the\nslot is valid. The test is also not sufficient by itself, as it reads\npg_vec without pg_vec_lock, so it can race with packet_set_ring.\n\nAs a result a slot is released when its payload is copied, which can\nbe before transmission (e.g., in skb_orphan_frags_rx). If copied\nbefore skb_tx_timestamp() is called, no slot timestamp is recorded,\nsimilar to when skb_orphan() was called early in the datapath before\nthis patch.\n\nRevert the now unused previous skb_zcopy_.._nouarg infra.\n\nDepends on commit 992cc9f94ca9 (\"net/packet: defer vmalloc TX_RING\nfree until skbs finish\").",
      "affected": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "versions": [
            {
              "version": "5cd8d46ea1562be80063f53c7c6a5f40224de623",
              "status": "affected",
              "versionType": "git",
              "lessThan": "e67c455d79fbf709a94965f09a2be6bf4f4ba5fd"
            },
            {
              "version": "5cd8d46ea1562be80063f53c7c6a5f40224de623",
              "status": "affected",
              "versionType": "git",
              "lessThan": "eda9bcb721f15a93746a99eabda33d80b86404fd"
            },
            {
              "version": "5cd8d46ea1562be80063f53c7c6a5f40224de623",
              "status": "affected",
              "versionType": "git",
              "lessThan": "2a0c9afefc0ecea2cc30ccfbbbc98182a0986191"
            },
            {
              "version": "5cd8d46ea1562be80063f53c7c6a5f40224de623",
              "status": "affected",
              "versionType": "git",
              "lessThan": "9518405613863d0bf0700927a21367f5942cf058"
            },
            {
              "version": "67f6fba765ef8cb19089d476e3c367212a2fbdfd",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "f2a67e68dbaeae7c88e5522873d7b908911f9f77",
              "status": "affected",
              "versionType": "git"
            },
            {
              "version": "4.14.86",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "4.15"
            },
            {
              "version": "4.19.7",
              "status": "affected",
              "versionType": "semver",
              "lessThan": "4.20"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "versions": [
            {
              "version": "4.20",
              "status": "affected"
            },
            {
              "version": "0",
              "status": "unaffected",
              "versionType": "semver",
              "lessThan": "4.20"
            },
            {
              "version": "6.12.112",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.12.*"
            },
            {
              "version": "6.18.55",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "6.18.*"
            },
            {
              "version": "7.2.9",
              "status": "unaffected",
              "versionType": "semver",
              "lessThanOrEqual": "7.2.*"
            },
            {
              "version": "7.3",
              "status": "unaffected",
              "versionType": "original_commit_for_fix",
              "lessThanOrEqual": "*"
            }
          ]
        }
      ]
    }
  }
}