[SRU][Q/N][PATCH 0/2] CVE-2026-43198

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-43198

[ Impact ]

In tcp_v6_syn_recv_sock(), code executed after the call to
tcp_v4_syn_recv_sock() runs too late. By that point the child socket is already
visible in the TCP ehash table and can be accessed by other CPUs, while
newinet->pinet6 still points to the listener's ipv6_pinfo. This race can lead
to use of stale or incorrect socket state, which syzbot was able to trigger.
Given the high CVSS score of 9.8, this is a serious remotely-reachable issue in
the TCP stack.

[ Fix ]

questing: backported with AI-assisted adaptation
noble: backported with AI-assisted adaptation
xenial: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

If the fix is incorrect, regressions would surface in the TCP/IPv6 connection
establishment path, particularly for IPv4-mapped IPv6 sockets, potentially
causing connection setup failures or socket state corruption under load.