{ "schema_version": "1.6.1", "id": "RPI-CVE-2026-98595", "modified": "2026-10-19T04:30:01Z", "upstream": [ "CVE-2026-98595" ], "published": "2026-10-18T15:22:13Z", "summary": "udp: remove a disconnected socket from the 4-tuple hash table", "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nudp: remove a disconnected socket from the 4-tuple hash table\n\nA UDP socket bound to a specific address and port keeps its entry in the\n4-tuple hash table after it is disconnected:\n\n sk binds to 127.0.0.1:21001\n sk connects to 127.0.0.2:20001\t// filed in the 4-tuple table\n sk disconnects, connect(AF_UNSPEC)\t// still filed, peer now 0.0.0.0:0\n\n__udp_disconnect() takes a socket out of that table only as a side effect\nof ->rehash() or ->unhash(), and it skips ->rehash() when\nSOCK_BINDADDR_LOCK is set and ->unhash() when SOCK_BINDPORT_LOCK is set.\ncommit 6996a2d2d0a6 (\"udp: Unhash auto-bound connected sk from 4-tuple hash\ntable when disconnected.\") fixed the same end state for a wildcard-bound\nsocket, by a path this one does not take.\n\nThe entry is counted whether or not anything hits it. hash4_cnt on the\nhash2 slot stays raised for as long as the socket lives, so udp_has_hash4()\nkeeps sending every packet for that address and port through the 4-tuple\nlookup first.\n\nOn IPv6 it can also be hit. __udp_disconnect() does not clear sk_v6_daddr,\nso udp_v6_rehash() files the entry under the peer the socket was connected\nto with a zero dport, and inet6_match() compares that same\nfield: a datagram from the former peer with a zero source port matches,\nand source port zero is accepted on receive. On IPv4 the peer is cleared,\nso a match would need a zero source address as well, which the routing\nlayer rejects as martian. The stale sk_v6_daddr is a separate defect, not\naddressed here; removing the entry closes this path either way.\n\nThe entry can also be relocated. __udp_disconnect() clears sk_bound_dev_if,\nso a subsequent SO_BINDTODEVICE calls ->rehash(), and because the receive\naddress is still specific udp_lib_rehash() moves the entry instead of\nremoving it, into the bucket that (rcv_saddr, num, 0, 0) hashes to -- a\npure function of the address and port, so every socket reaching this state\non one address and port collects in one bucket. The bucket cannot be chosen\nfrom outside, as udp_ehashfn() is seeded with a per-boot secret. This last\none became reachable only with commit 644f9108f3a5 (\"udp: Make rehash4\nindependent in udp_lib_rehash()\"), which moved the hash4 handling out of a\nbranch a disconnected socket does not take; the stale entry itself dates\nfrom the commit in Fixes.\n\nTake the socket out of the table before __udp_disconnect() runs, while it\nstill matches how it was filed. This also reaches the wildcard case ahead\nof udp_lib_rehash()'s udp_unhash4() branch, leaving that branch unreachable\nfrom udp_disconnect(); removing it belongs in net-next. udp_disconnect()\nand udp_abort() are the only UDP entries into __udp_disconnect(), which is\nshared with raw, ping and l2tp sockets that are not struct udp_sock:\nping_prot.obj_size is sizeof(struct inet_sock), so udp_hashed4() on one\nwould read past the allocation.", "affected": [ { "package": { "ecosystem": "Raspberry Pi OS:13", "name": "linux" }, "versions": [ "1:6.18.29-1+rpt1", "1:6.18.33-1+rpt1", "1:6.18.34-1+rpt1", "1:6.18.39-1+rpt1", "1:6.18.50-1+rpt1" ], "ecosystem_specific": { "binaries": [ { "binary_name": "linux-image-6.18.29+rpt-rpi-2712", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v6", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v7", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.29+rpt-rpi-v8-rt", "binary_version": "1:6.18.29-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-2712", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v6", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v7", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.33+rpt-rpi-v8-rt", "binary_version": "1:6.18.33-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-2712", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v6", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v7", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.34+rpt-rpi-v8-rt", "binary_version": "1:6.18.34-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-2712", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v6", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v7", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.39+rpt-rpi-v8-rt", "binary_version": "1:6.18.39-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-2712", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v6", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v7", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8", "binary_version": "1:6.18.50-1+rpt1" }, { "binary_name": "linux-image-6.18.50+rpt-rpi-v8-rt", "binary_version": "1:6.18.50-1+rpt1" } ] }, "database_specific": { "per_version": { "1:6.18.29-1+rpt1": { "linux_commit": "66318c5b5cd8145a662303af12ed39ac07eb27cc", "upstream_version": "6.18.29", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.55" }, "1:6.18.33-1+rpt1": { "linux_commit": "95b85bebbedcaedfa7ca79116ed38b7376fba412", "upstream_version": "6.18.33", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.55" }, "1:6.18.34-1+rpt1": { "linux_commit": "c8c7494100e99ee05b11aaa4f0588a223a63d1af", "upstream_version": "6.18.34", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.55" }, "1:6.18.39-1+rpt1": { "linux_commit": "60ea684a8ace97bb0db1a16e20753bdd6ab371ff", "upstream_version": "6.18.39", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.55" }, "1:6.18.50-1+rpt1": { "linux_commit": "cff533aec2fa601846766b32ff57204e0a61bed7", "upstream_version": "6.18.50", "assessment": "commit ancestry (strak rule)", "upstream_fixed": "6.18.55" } } } } ], "references": [ { "type": "ADVISORY", "url": "https://www.cve.org/CVERecord?id=CVE-2026-98595" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/c21daf37d5ce9a4e234b7c42238ac1e6041e28e4" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/d1b5fd969cc53f29d02b82b05a45135de4a6087a" }, { "type": "FIX", "url": "https://git.kernel.org/stable/c/9e95b1a94c9c49b4ba722251bbca2759b9c51737" } ], "database_specific": { "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git", "upstream_modified": "2026-10-18T15:22:13Z" } }