CVE detail
CVE-2026-43198
In the Linux kernel, the following vulnerability has been resolved: tcp: fix potential race in tcp_v6_syn_recv_sock() Code in tcp_v6_syn_recv_sock() after the call to tcp_v4_syn_recv_sock() is done too late. After tcp_v4_syn_recv_sock(), the child socket is already visible from TCP ehash table and other cpus might use it. Since newinet->pinet6 is still pointing to the listener ipv6_pinfo bad things can happen as syzbot found. Move the problematic code in tcp_v6_mapped_child_init() and call this new helper from tcp_v4_syn_recv_sock() before the ehash insertion. This allows the removal of one tcp_sync_mss(), since tcp_v4_syn_recv_sock() will call it with the correct context.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 30.0 · diversity 18.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
21 source links · newest first
Information published.
vendormsrc.microsoft.comMay 7, 2026, 8:05 AM- https://access.redhat.com/errata/RHSA-2026:41236access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM - https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-43198.jsonsecurity.access.redhat.com
No excerpt available.
Vendor Advisorysecurity.access.redhat.comMay 6, 2026, 12:16 PM - https://bugzilla.redhat.com/show_bug.cgi?id=2467228bugzilla.redhat.com
No excerpt available.
Exploitbugzilla.redhat.comMay 6, 2026, 12:16 PM - https://access.redhat.com/security/cve/CVE-2026-43198access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:36349access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:36348access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:36216access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:36073access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:35904access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:35896access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:35894access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:35863access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:34443access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:34094access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:33285access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:33215access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM - https://access.redhat.com/errata/RHSA-2026:30129access.redhat.com
No excerpt available.
Vendor Advisoryaccess.redhat.comMay 6, 2026, 12:16 PM No excerpt available.
Vendor Advisorygit.kernel.orgMay 6, 2026, 12:16 PMNo excerpt available.
Vendor Advisorygit.kernel.orgMay 6, 2026, 12:16 PMNo excerpt available.
Vendor Advisorygit.kernel.orgMay 6, 2026, 12:16 PM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-53400CVSS 7.8 · High
In the Linux kernel, the following vulnerability has been resolved: i2c: core: fix adapter registration race Adapters can be looked up based on their id using i2c_get_adapter()…
- CVE-2026-53352CVSS 4.7 · Medium
In the Linux kernel, the following vulnerability has been resolved: signal: clear JOBCTL_PENDING_MASK for caller in zap_other_threads() When a multi-threaded process receives a…
- CVE-2026-13882CVSS 9.6 · Critical
Race in USB in Google Chrome prior to 150.0.7871.47 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML p…
- CVE-2026-13874CVSS 5.3 · Medium
Race in DataTransfer in Google Chrome prior to 150.0.7871.47 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Ch…
- CVE-2026-53108CVSS 4.7 · Medium
In the Linux kernel, the following vulnerability has been resolved: powerpc/64s: Fix unmap race with PMD migration entries The following race is possible with migration swap ent…
- CVE-2026-53086CVSS 9.8 · Critical
In the Linux kernel, the following vulnerability has been resolved: net: bcmgenet: fix racing timeout handler The bcmgenet_timeout handler tries to take down all tx queues when…