CVE-2026-43216

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: Drop the lock in skb_may_tx_timestamp()

skb_may_tx_timestamp() may acquire sock::sk_callback_lock. The lock must

not be taken in IRQ context, only softirq is okay. A few drivers receive

the timestamp via a dedicated interrupt and complete the TX timestamp

from that handler. This will lead to a deadlock if the lock is already

write-locked on the same CPU.

Taking the lock can be avoided. The socket (pointed by the skb) will

remain valid until the skb is released. The ->sk_socket and ->file

member will be set to NULL once the user closes the socket which may

happen before the timestamp arrives.

If we happen to observe the pointer while the socket is closing but

before the pointer is set to NULL then we may use it because both

pointer (and the file's cred member) are RCU freed.

Drop the lock. Use READ_ONCE() to obtain the individual pointer. Add a

matching WRITE_ONCE() where the pointer are cleared.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References