CVE-2026-98801 net: restrict SO_RESERVE_MEM to TCP sockets and cap max value

Not scored Published 18 Oct 2026 Updated 19 Oct 2026

A local attacker can trigger integer overflows and memory corruption in the Linux kernel via SO_RESERVE_MEM, potentially causing denial of service or privilege escalation.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-98801?

CVE-2026-98801 is a vulnerability in Linux, published on 18 Oct 2026. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

net: restrict SO_RESERVE_MEM to TCP sockets and cap max value

Commit 2bb2f5fb21b0 ("net: add new socket option SO_RESERVE_MEM") and commit d00c8ee31729 ("net: fix possible NULL deref in sock_reserve_memory") only checked sk_has_account(sk), which is true for both TCP and UDP sockets.

However, SO_RESERVE_MEM and sk_unused_reserved_mem() are currently only supported by TCP: - On UDP sockets, sk->sk_forward_alloc is protected by sk->sk_receive_queue.lock, whereas sock_reserve_memory() and sock_release_reserved_memory() only acquire lock_sock(sk). Concurrent UDP packet reception/release and setsockopt(SO_RESERVE_MEM) corrupt sk_forward_alloc and memcg accounting. - udp_rmem_release() reclaims excess sk_forward_alloc without accounting for sk_unused_reserved_mem(sk).

Restrict sock_reserve_memory() to TCP sockets (sk_is_tcp(sk)) for now. Supporting SO_RESERVE_MEM for UDP (acquiring sk_receive_queue.lock and honoring sk_unused_reserved_mem() in udp_rmem_release()) can be done in a future net-next series if needed.

In addition, reject val > SZ_1G with -EINVAL in sk_setsockopt(SO_RESERVE_MEM). Without an upper bound, values near INT_MAX cause sk_mem_pages(delta) and (pages << PAGE_SHIFT) to overflow 32-bit signed int, corrupting sk->sk_forward_alloc and sk->sk_reserved_mem. Using a page-aligned cap (SZ_1G) ensures that the page-rounded sk->sk_reserved_mem reported by getsockopt(SO_RESERVE_MEM) can always be passed back to setsockopt(SO_RESERVE_MEM).

Which versions are affected by CVE-2026-98801?

How do I fix CVE-2026-98801?

Apply the vendor's patch.

Is CVE-2026-98801 being exploited?

There is no known exploitation of CVE-2026-98801 in the wild and no public exploit code.

Sources

Also known as AZL-109077, BELL-CVE-2026-98801, DEBIAN-CVE-2026-98801, GHSA-4vp5-jwr6-3q9m, UBUNTU-CVE-2026-98801.