Detections
Analytics

Bottlerocket: bottlerocket-kernel-6.1, kernel-6.1: security update to 6.1.189

critical Tenable Cloud Security Plugin ID 478360

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: ipv4: free inet_opt and ireq_opt after
 an RCU grace period tcp_v4_syn_recv_sock() transfers ownership of ireq->ireq_opt to the child socket
 (newinet->inet_opt) without copying it. Another cpu can concurrently process a retransmitted SYN for the
 same request socket, and send a SYNACK from tcp_check_req(). tcp_v4_send_synack() and inet_csk_route_req()
 read ireq->ireq_opt under rcu_read_lock() only, and ip_build_and_send_pkt() and ip_options_build() then
 read opt->optlen twice. Note that the SYNACK timer itself is not an issue: it holds a reference on its
 request socket, and inet_csk_reqsk_queue_drop() calls timer_delete_sync() before the child can be freed.
 Since commit 079096f103fa ("tcp/dccp: install syn_recv requests into ehash table"), request sockets are
 processed without holding the listener lock, so nothing prevents the child socket from being freed while
 the SYNACK is still being built. TCP child sockets do not have SOCK_RCU_FREE, and inet_sock_destruct()
 frees inet_opt with a plain kfree(), leading to a use-after-free in ip_options_build(). A similar issue
 exists with request socket migration (net.ipv4.tcp_migrate_req=1, or a BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
 program). reqsk_timer_handler() clones the request socket with inet_reqsk_clone(), so that the old request
 socket and its clone share the same ireq_opt, then reqsk_migrate_reset() clears the pointer in the old
 one. Another cpu holding a reference on the old request socket can still be using these options (sending a
 SYNACK, or creating a child in tcp_v4_syn_recv_sock()) when the clone is freed, and
 tcp_v4_reqsk_destructor() also uses a plain kfree(). Readers already use RCU, and other paths replacing
 inet_opt (do_ip_setsockopt(), cipso_v4_sock_setattr()...) already use kfree_rcu(). Use kfree_rcu() in
 inet_sock_destruct() and tcp_v4_reqsk_destructor() as well. IPv6 is not affected by the first issue,
 because tcp_v6_syn_recv_sock() duplicates the options. tcp_v6_reqsk_destructor() has the same migration
 issue with ipv6_opt, which is only set by CALIPSO. This will be addressed in a separate patch.
 (CVE-2026-98432)

Solution

Update the bottlerocket-kernel-6.1 library and its related packages to version 6.1.189 or later.

Plugin Details

Severity: Critical

ID: 478360

Version: Revision 1.1

Type: Local

Published: 11/5/2026

Updated: 11/5/2026

Risk Information

VPR

Risk Factor: High

Score: 8.9

Percentile: 99.72

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.8

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2026-98432

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.8

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:P/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 10/15/2026

Reference Information

CVE: CVE-2026-98432