CVE-2026-99056 strparser: make sure __strp_recv isn't running before tearing down the parser
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-99056?
CVE-2026-99056 is a high-severity vulnerability in Linux, published on 23 Oct 2026.
Official description
In the Linux kernel, the following vulnerability has been resolved:
strparser: make sure __strp_recv isn't running before tearing down the parser
The comment above strp_done() claims that if strp is stopped, strp_recv will no longer be called. That's only true if the caller has a mechanism (eg locking) to guarantee that strp_recv() calls that started before strp_stop() have completed by the time we call strp_done().
This adds a dummy lock_sock/release_sock pair to guarantee that any in-flight strp_recv() (which runs under either bh_lock_sock or lock_sock, depending if it's called from ->sk_data_ready or strp_work) has completed.
Only espintcp can be affected by this race condition, but this patch makes sure no future user of strp can have the bug.
This could crash on strp->sk ("general mode" of strp), but this mode has been here for 9 years and has never been used. It'll be gone soon, no point worrying about it.
Switch the stopped/paused/etc bits to u8's to avoid races between strp_stop() and strp_pause/unpause().
A reproducer has been published and turns the possible UAF into an exploit [1].
Which versions are affected by CVE-2026-99056?
How do I fix CVE-2026-99056?
Upgrade to a fixed version.
Is CVE-2026-99056 being exploited?
There is no known exploitation of CVE-2026-99056 in the wild and no public exploit code.
Sources
Also known as AZL-110939, BELL-CVE-2026-99056, DEBIAN-CVE-2026-99056, GHSA-cxj6-cg32-r3fc, UBUNTU-CVE-2026-99056.