CVE-2026-98276: Patched kernels available in testing

Key points

AlmaLinux has built kernels for AlmaLinux 8, 9 and 10 that fix CVE-2026-98276, a local use-after-free in the kernel's socket code. The kernels are in the testing repository now, and the project is asking users to verify them before moving them to production. The post will be updated when that happens.

The flaw

• The SIOCGSTAMP family of ioctls switches on packet timestamping the first time it is called on a socket, but it changed the socket's flag word without holding the socket lock. Two CPUs updating that word at once can overwrite each other's bits.
• If the ioctl races with bind() on a UDP socket, it can clear the flag that delays freeing the socket until after a grace period. The lockless UDP receive path relies on that delay.
• When that flag is lost, closing the socket frees it immediately while the receive path may still hold a pointer to it.
• The bug has existed since 2.6.12, the start of the kernel's git history.
• The upstream fix is 9ed55f3dbef4 ("net: lock the socket in sock_gettstamp()"), written by Eric Dumazet and reviewed by Simon Horman. It takes the lock only when the timestamping flag actually needs setting, so the common case stays lockless.
• Jungwoo Lee and Wongi Lee reported the issue.

Severity and who is exposed

• The Linux kernel CVE team scores it CVSS 7.8 (High). An attacker needs a local account that can run code, but no special privileges and no user interaction.
• Red Hat rates it Moderate (CVSS 7.0) because it considers the race hard to win reliably. AlmaLinux considers the bug a local-to-root class issue that needs prompt attention either way.
• It cannot be triggered by network traffic alone. The attacker has to create a UDP socket and race bind() against the ioctl.
• Systems where untrusted users can run code should be treated as exposed, including multi-tenant hosts, shared build and CI machines, and hosts running user-supplied containers.
• The reporters demonstrated the use-after-free with a kernel memory checker. AlmaLinux knows of no public exploit at the time of writing.

Shipping ahead of RHEL

• No fixed RHEL kernel exists yet, and Red Hat lists the RHEL 8, 9 and 10 kernels as affected.
• The AlmaLinux core team backported the fix from the 5.15 and 6.12 stable kernels. The technical steering committee, ALESCo, approved releasing it before a CentOS Stream / RHEL update.
• The AlmaLinux 8 kernel (4.18) predates a 2019 rework of these ioctls, so the fix could not be applied as is:
• It was adapted to the equivalent helpers in that kernel.
• The qrtr, ax25 and netrom handlers, which call those helpers with the socket lock already held, were adjusted to match later upstream code.
• Testing on AlmaLinux 8 is especially wanted.

Fixed versions

• AlmaLinux 8: kernel-4.18.0-553.184.2.el8_10
• AlmaLinux 9: kernel-5.14.0-687.66.2.el9_8
• AlmaLinux 10: kernel-6.12.0-211.74.2.el10_2
• Install the listed version for your release, or a newer one.

How to test

• Install the testing repository package, update the kernel from it and reboot:

sudo dnf install -y almalinux-release-testing
sudo dnf update 'kernel*' --enablerepo=almalinux-testing
sudo reboot

• Check the running kernel with uname -r or rpm -q kernel and compare it with the versions above.
• After rebooting, turn the testing repository off. The project advises this especially on production machines:

sudo dnf config-manager --disable almalinux-testing

• Report problems in AlmaLinux chat or at bugs.almalinux.org.

Workaround

• There is no practical workaround. Any process can open a UDP socket and issue the ioctl, so no module can be blocked and no firewall rule helps.
• Limiting who can run code on the machine reduces exposure. Otherwise, install the patched kernel and reboot as soon as possible.

Staying informed

• AlmaLinux will update the post when the kernels reach the production repositories.
• Updates also go out through the AlmaLinux Blog, the Mattermost Community Chat, and the Announce and Security mailing lists.

Summary by DistroNews, based on the original post.