{"answers":{"affected":"","exploited":"There is no known exploitation of CVE-2026-98925 in the wild and no public exploit code.","fix":"Upgrade to a fixed version.","what":"CVE-2026-98925 is a vulnerability in Linux, published on 23 Oct 2026."},"fix_prompt":"Check this codebase for CVE-2026-98925 and fix it if it is affected.\n\nWhat it is: CVE-2026-98925 is a vulnerability in Linux, published on 23 Oct 2026. \nExploitation: There is no known exploitation of CVE-2026-98925 in the wild and no public exploit code.\n\nAffected product: Linux. No package-level version data is available, so check the vendor advisory linked from the reference page.\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2026-98925/ (Markdown: https://insights.sbomify.com/CVE-2026-98925/index.md)","id":"CVE-2026-98925","markdown":"https://insights.sbomify.com/CVE-2026-98925/index.md","name":"CVE-2026-98925","record":{"aliases":["AZL-110995","BELL-CVE-2026-98925","DEBIAN-CVE-2026-98925","GHSA-qjhh-724f-rp7q","UBUNTU-CVE-2026-98925"],"analysis":null,"analysis_generated_by":null,"assigner":"Linux","cpe":[],"cvss":{"score":null,"severity":null,"source":null,"vector":null,"version":null},"cwes":[],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nbpf, sockmap: Fix self-redirect copied_seq double-counting\n\nWhen a BPF stream_verdict program redirects an skb back to the same\nsocket (self-redirect with BPF_F_INGRESS), sk_psock_verdict_apply()\ncalls tcp_eat_skb() which advances tcp_sk-\u003ecopied_seq. However, the\nskb is then delivered to the socket's psock ingress queue and later\nread by tcp_bpf_recvmsg_parser(), which also advances copied_seq via\nthe copied_from_self accounting path. This double-counting causes\ncopied_seq to advance by 2x the actual data length, triggering:\n\n  TCP recvmsg seq # bug 2: copied BF2E806, seq BF2E7FD, \\\n\t\t\t   rcvnxt BF2E806, fl 0\n  WARNING: net/ipv4/tcp.c:2745 at tcp_recvmsg_locked+0x72b/0x2640\n  Call Trace:\n   tcp_recvmsg+0x10a/0x500\n   sock_recvmsg+0x168/0x1d0\n   __sys_recvfrom+0x19a/0x2a0\n   __x64_sys_recvfrom+0xe4/0x1f0\n   do_syscall_64+0xf7/0x530\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\n  cleanup rbuf bug: copied BF2E806 seq BF2E806 rcvnxt BF2E806\n  WARNING: net/ipv4/tcp.c:1609 at tcp_cleanup_rbuf+0xf2/0x1c0\n  Call Trace:\n   tcp_recvmsg_locked+0x8d1/0x2640\n   tcp_recvmsg+0x10a/0x500\n   sock_recvmsg+0x168/0x1d0\n   __sys_recvfrom+0x19a/0x2a0\n   __x64_sys_recvfrom+0xe4/0x1f0\n   do_syscall_64+0xf7/0x530\n   entry_SYSCALL_64_after_hwframe+0x77/0x7f\n\nFix this by converting self-redirect verdict to __SK_PASS at the\nbeginning of sk_psock_verdict_apply(). This bypasses the\n__SK_REDIRECT case entirely (which calls sk_psock_eat_skb), letting\nthe __SK_PASS path queue the skb to the psock ingress queue. The\ndata is then read via tcp_bpf_recvmsg_parser(), which advances\ncopied_seq exactly once through copied_from_self. Cross-socket\nredirects continue through __SK_REDIRECT with sk_psock_eat_skb()\nunchanged.","ecosystems":[],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"bpf, sockmap: Fix self-redirect copied_seq double-counting","id":"CVE-2026-98925","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":null,"product":null,"products":[],"type":null,"year":"2026"},"n_packages":0,"n_references":6,"next":{"headline":"drm/amd/display: Remove sink usage from DPMS","id":"CVE-2026-98926"},"packages":[],"prev":{"headline":"fs: avoid repeated scans in evict_inodes()","id":"CVE-2026-98924"},"products":["Linux"],"published":"2026-10-23","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2026-10-23","vendors":["Linux"]},"summary":null,"url":"https://insights.sbomify.com/CVE-2026-98925/"}