[SRU][J][PATCH 0/1] CVE-2026-43198

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-43198

[ Impact ]

In tcp_v6_syn_recv_sock(), the code following the call to
tcp_v4_syn_recv_sock() executes too late. Once tcp_v4_syn_recv_sock() returns,
the child socket is already visible in the TCP ehash table and other CPUs can
access it, while newinet->pinet6 still points to the listener's ipv6_pinfo.
This race allows concurrent CPUs to operate on a partially initialized socket,
leading to memory corruption or other undefined behavior that can be triggered
remotely.

[ Fix ]

jammy: backported with AI-assisted adaptation
bionic: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

If the fix is incorrect, regressions would surface in the TCP/IPv6 stack,
particularly during connection establishment for IPv4-mapped IPv6 sockets,
potentially causing incorrect socket initialization, connection failures, or
crashes under load.