backport/fix for CVE-2026-43198 missing 6.12.x ?

"Joakim Tjernlund (Nokia)" <[email protected]>
Newsgroups org.kernel.vger.stable
Message-ID <[email protected]>
Looking in latest 6.12.x kernel I cannot find any evidence of a fix for CVE-2026-43198.
Is it missing or is 6.12.x unaffected ?


CVE-2026-43198:
tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to
tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already
visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing
to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in
tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash
insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it
with the correct context.
lmpx.com only provides a reader for public news (NNTP) servers. It is not affiliated with the servers or forums shown here and is not responsible for the content of articles, which is written by their respective authors.