{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.113-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.2.10-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  net: restrict SO_RESERVE_MEM to TCP sockets and cap max value  Commit 2bb2f5fb21b0 (\"net: add new socket option SO_RESERVE_MEM\") and commit d00c8ee31729 (\"net: fix possible NULL deref in sock_reserve_memory\") only checked sk_has_account(sk), which is true for both TCP and UDP sockets.  However, SO_RESERVE_MEM and sk_unused_reserved_mem() are currently only supported by TCP: - On UDP sockets, sk-\u003esk_forward_alloc is protected by   sk-\u003esk_receive_queue.lock, whereas sock_reserve_memory() and   sock_release_reserved_memory() only acquire lock_sock(sk). Concurrent   UDP packet reception/release and setsockopt(SO_RESERVE_MEM) corrupt   sk_forward_alloc and memcg accounting. - udp_rmem_release() reclaims excess sk_forward_alloc without   accounting for sk_unused_reserved_mem(sk).  Restrict sock_reserve_memory() to TCP sockets (sk_is_tcp(sk)) for now. Supporting SO_RESERVE_MEM for UDP (acquiring sk_receive_queue.lock and honoring sk_unused_reserved_mem() in udp_rmem_release()) can be done in a future net-next series if needed.  In addition, reject val \u003e SZ_1G with -EINVAL in sk_setsockopt(SO_RESERVE_MEM). Without an upper bound, values near INT_MAX cause sk_mem_pages(delta) and (pages \u003c\u003c PAGE_SHIFT) to overflow 32-bit signed int, corrupting sk-\u003esk_forward_alloc and sk-\u003esk_reserved_mem. Using a page-aligned cap (SZ_1G) ensures that the page-rounded sk-\u003esk_reserved_mem reported by getsockopt(SO_RESERVE_MEM) can always be passed back to setsockopt(SO_RESERVE_MEM).",
  "id": "DEBIAN-CVE-2026-98801",
  "modified": "2026-10-19T04:47:23.879720291Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-98801"
    }
  ],
  "upstream": [
    "CVE-2026-98801"
  ]
}