CVE-2026-98384: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98384 is an out-of-bounds read vulnerability in the Linux kernel's BPF subsystem, specifically in the bpf_sock_destroy() helper function. The flaw arises because sk_protocol is incorrectly read from timewait or request socket objects passed by the TCP iterator, even though sk_protocol resides in struct sock rather than struct sock_common. Affected kernel versions begin at 6.5; fixed versions include 6.6.158, 6.12.112, 6.18.55, 7.2.9, and 7.3-rc5. The vulnerability was published on October 9, 2026, and is estimated as Medium severity (GitHub Advisory, Feedly).

The root cause is an out-of-bounds read (CWE-125) in bpf_sock_destroy(), where the function unconditionally accesses sk->sk_protocol on any socket object handed to it by the TCP iterator — including TIME_WAIT and NEW_SYN_RECV (request) sockets. These socket types are based on struct sock_common, not the full struct sock, so reading sk_protocol at its expected offset reads past the allocated object boundary. KASAN reports a slab-out-of-bounds read of 2 bytes at the offending address. The fix restricts the sk_protocol check to full socket objects only, relying on tcp_abort() to handle timewait and request sockets correctly (GitHub Advisory).

Successful exploitation allows a local attacker with BPF program execution capability to trigger a kernel slab-out-of-bounds read, potentially disclosing sensitive kernel memory contents. The primary impact is a confidentiality breach through kernel memory disclosure; integrity and availability are not directly affected by this read-only bug. The scope is limited to the local system, but leaked kernel memory could facilitate further privilege escalation or KASLR bypass in a chained attack (Feedly).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation as of the disclosure date (Feedly). Exploitation requires local access and the ability to load BPF programs, either via unprivileged BPF (if enabled) or with the CAP_BPF capability. The EPSS score is approximately 0.156%, reflecting low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Apply the upstream kernel patches that restrict sk_protocol access in bpf_sock_destroy() to full socket objects only. Fixed stable kernel versions are 6.6.158, 6.12.112, 6.18.55, 7.2.9, and 7.3-rc5 (GitHub Advisory). As a configuration-based workaround, restrict unprivileged BPF program loading by setting kernel.unprivileged_bpf_disabled=1 via sysctl, and limit CAP_BPF capability assignment to trusted users only until patching is feasible.