CVE-2026-99056
Description
A flaw was found in the Linux kernel's stream parser component. A race condition occurs when stopping the stream parser while socket receive operations are still actively executing. A local attacker could exploit this timing issue to cause a use-after-free memory error, potentially leading to privilege escalation or a Denial of Service (DoS) via a system crash.
Statement
This vulnerability is rated as an Important severity flaw because an authenticated local user can leverage a use-after-free condition in the kernel to achieve complete privilege escalation or cause a system crash, without requiring physical access or administrative privileges. Although the underlying race condition specifically affects teardown handling in the stream parser when processing ESP encapsulated over TCP (espintcp) sockets, the resulting memory corruption directly compromises host kernel integrity. Typical Red Hat Enterprise Linux deployments hosting multi-tenant workloads or unprivileged users with local socket access are primarily exposed to this risk.
Mitigation
--- CME Mitigation Guidance (2026-11-02) ---
Disclaimer: The following mitigation solutions are provided as a courtesy, pending the application of an official patch. This content was generated utilizing AI tools in conjunction with data from https://cmetaxonomy.org. Customers are advised to independently evaluate and test these temporary mitigations within their own infrastructure.
The highest-value action is to synchronize stream parser teardown with in-flight receive processing and convert parser state flags to independent members to prevent use-after-free conditions: upgrade to the fixed Kernel/Kernel Rt/Kernel Ivos Qualcomm/Openshift/Ose Rhel Coreos/Kpatch builds, which adds a lock_sock and release_sock pair in strp_done to wait for active receive processing to finish and converts parser state bitfield flags into u8 members, closing all 2 injection vectors (concurrent socket stream parser teardown during in-flight receive processing, unsynchronized bitfield state updates between parser stop and pause operations). Until patched, this is only a concern on Linux multi-tenant systems or hosts granting unprivileged local users access to create and tear down stream parser sockets such as espintcp — Non-Linux platforms are unaffected — so Restrict unprivileged local user access and constrain process capabilities to prevent unauthorized local users from creating or manipulating espintcp stream parser sockets. As a compensating measure, Enable runtime memory error detection with KASAN or HWASan to detect use-after-free memory errors at runtime using allocation quarantines and redzones, Enable SLAB freelist hardening to randomize freelist allocation order and validate freelist pointer integrity against exploitation, Enforce SELinux in enforcing mode to constrain unprivileged processes and limit post-exploitation actions, Enable KASLR to randomize kernel code locations and impede ROP chain construction, Enable SMEP to prevent the kernel from executing userspace shellcode if control flow is redirected, and Enable SMAP to prevent kernel dereferences of userspace memory structures used to forge freed socket or parser objects. These controls limit blast radius and contain exploitation, but they do not fix the underlying stream parser use-after-free race condition — apply the upstream patch to fully remediate.
Highest-impact CME: CME-301 SELinux (Enforcing Mode) (medium)
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7.8 | N/A | 7.8 |
| Attack Vector | Local | N/A | Local |
| Attack Complexity | Low | N/A | Low |
| Privileges Required | Low | N/A | Low |
| User Interaction | None | N/A | None |
| Scope | Unchanged | N/A | Unchanged |
| Confidentiality | High | N/A | High |
| Integrity Impact | High | N/A | High |
| Availability Impact | High | N/A | High |
Vector
Red Hat: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
cve.org: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Understanding the Weakness (CWE)
Integrity,Other
Technical Impact: Alter Execution Logic; Unexpected State
The main problem is that -- if a lock is overcome -- data could be altered in a bad state.
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
