CVE-2026-43198: tcp: fix potential race in tcp_v6_syn_recv_sock()
Published May 6, 2026
·Updated
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
10 affected componentsFixes available
Linux Linux kernel
Linux Linux kernel>=2.6.12.1<6.18.16
Linux Linux kernel>=6.19<6.19.6
Linux Linux kernel=2.6.12
Linux Linux kernel=2.6.12-rc2
Linux Linux kernel=2.6.12-rc3
Linux Linux kernel=2.6.12-rc4
Linux Linux kernel=2.6.12-rc5
Linux Linux kernel=7.0-rc1
debian/linux<=5.10.223-1, <=5.10.262-1, <=6.1.176-1, <=6.1.180-1, <=6.12.94-1, <=6.12.101-1
7.1.7-17.1.8-1
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.7-1Fixed in 7.1.8-1
Event History
May 6, 2026
CVE Published
via MITRE·11:28 AM
Data Sourced
via MITRE·11:28 AM
DescriptionSeverity
Data Sourced
via NVD·12:16 PM
RemedyDescriptionSeverityWeaknessAffected Software
Data Sourced
via Red Hat·01:11 PM
DescriptionSeverityAffected Software
Aug 12, 2026
Data Sourced
via Debian·08:39 PM
DescriptionAffected Software
Aug 13, 2026
Data Sourced
via Launchpad·08:41 PM
Description
Aug 14, 2026
Data Sourced
via Ubuntu·08:41 PM
RemedyDescriptionSeverityAffected Software
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The severity vector indicates that exploitation is possible over the network, with low attack complexity, no privileges required, and no user interaction required.
2
What security impact could successful exploitation have?
The assigned critical severity vector indicates high impact to confidentiality, integrity, and availability.
3
Which systems are in scope?
The affected software listed is the Linux kernel, including Debian's linux package. The flaw involves TCP IPv6 child-socket handling after a socket becomes visible in the TCP established-hash table.