AZL-110939: CVE-2026-99056 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved:
strparser: make sure strprecv isn't running before tearing down the parser
The comment above strpdone() claims that if strp is stopped, strprecv will no longer be called. That's only true if the caller has a mechanism (eg locking) to guarantee that strprecv() calls that started before strpstop() have completed by the time we call strpdone().
This adds a dummy locksock/releasesock pair to guarantee that any in-flight strprecv() (which runs under either bhlocksock or locksock, depending if it's called from ->skdataready or strpwork) has completed.
Only espintcp can be affected by this race condition, but this patch makes sure no future user of strp can have the bug.
This could crash on strp->sk ("general mode" of strp), but this mode has been here for 9 years and has never been used. It'll be gone soon, no point worrying about it.
Switch the stopped/paused/etc bits to u8's to avoid races between strpstop() and strppause/unpause().
A reproducer has been published and turns the possible UAF into an exploit [1].