CVE-2026-99056: strparser: make sure __strp_recv isn't running before tearing down the parser
In the Linux kernel, the following vulnerability has been resolved:
strparser: make sure strprecv isn't running before tearing down the parser
The comment above strpdone() claims that if strp is stopped, strprecv will no longer be called. That's only true if the caller has a mechanism (eg locking) to guarantee that strprecv() calls that started before strpstop() have completed by the time we call strpdone().
This adds a dummy locksock/releasesock pair to guarantee that any in-flight strprecv() (which runs under either bhlocksock or locksock, depending if it's called from ->skdataready or strpwork) has completed.
Only espintcp can be affected by this race condition, but this patch makes sure no future user of strp can have the bug.
This could crash on strp->sk ("general mode" of strp), but this mode has been here for 9 years and has never been used. It'll be gone soon, no point worrying about it.
Switch the stopped/paused/etc bits to u8's to avoid races between strpstop() and strppause/unpause().
A reproducer has been published and turns the possible UAF into an exploit [1].
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Before tearing down the strparser, use synchronization (including the dummy lock_sock/release_sock pair) to ensure any in-flight __strp_recv/strp_recv call has completed and no future strp_recv call can occur.