CVE-2026-98595

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

udp: remove a disconnected socket from the 4-tuple hash table

A UDP socket bound to a specific address and port keeps its entry in the

4-tuple hash table after it is disconnected:

sk binds to 127.0.0.1:21001

sk connects to 127.0.0.2:20001 // filed in the 4-tuple table

sk disconnects, connect(AF_UNSPEC) // still filed, peer now 0.0.0.0:0

__udp_disconnect() takes a socket out of that table only as a side effect

of ->rehash() or ->unhash(), and it skips ->rehash() when

SOCK_BINDADDR_LOCK is set and ->unhash() when SOCK_BINDPORT_LOCK is set.

commit 6996a2d2d0a6 ("udp: Unhash auto-bound connected sk from 4-tuple hash

table when disconnected.") fixed the same end state for a wildcard-bound

socket, by a path this one does not take.

The entry is counted whether or not anything hits it. hash4_cnt on the

hash2 slot stays raised for as long as the socket lives, so udp_has_hash4()

keeps sending every packet for th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References