AlmaLinux patches CVE-2026-98276 kernel race condition ahead of RHEL upstream

AlmaLinux has released patched kernels for CVE-2026-98276, a high-severity race condition in Linux socket code that can trigger a use-after-free on UDP sockets. The vulnerability, present since kernel 2.6.12, occurs when the SIOCGSTAMP ioctl sets a timestamping flag without holding the socket lock, potentially clobbering a grace-period flag set during bind() and causing premature socket freeing. A local unprivileged user can exploit this by racing bind() and ioctl calls on the same UDP socket. AlmaLinux's technical steering committee ALESCo approved shipping fixes ahead of upstream RHEL, which had not released patched kernels at the time of publication.

The distribution has backported Eric Dumazet's upstream fix to all supported branches: AlmaLinux 8 (kernel 4.18), AlmaLinux 9 (kernel 5.14), and AlmaLinux 10 (kernel 6.12). The AlmaLinux 8 backport required additional adaptation due to pre-2019 ioctl handler architecture. Patched kernels are currently in the testing repository and will move to production after community verification. The flaw is rated CVSS 7.8 by the Linux kernel CVE team and 7.0 by Red Hat, with no practical workaround available beyond restricting local code execution.

Socket locking flaw and backport complexity

• Race condition mechanism: The SIOCGSTAMP ioctl enables packet timestamping via an unlocked read-modify-write of socket flag bits, which can race with bind()'s setting of the SOCK_RCU_FREE grace-period flag on UDP sockets.
• Use-after-free trigger: When the ioctl wins the race and clears the grace-period flag, closing the socket causes immediate freeing while the UDP receive path may still hold a reference, resulting in use-after-free.
• Upstream fix approach: Eric Dumazet's patch takes the socket lock only when the timestamping flag actually needs modification, preserving the lockless fast path for subsequent calls.
• AlmaLinux 8 adaptation: The 4.18 kernel predates the 2019 ioctl rework, requiring the fix to be adapted to equivalent helpers and adjusting three protocol handlers (qrtr, ax25, netrom) that already held the socket lock.
• Backport scope: Fixes were applied from Linux stable kernels 5.15 and 6.12 to AlmaLinux 9 and 10, with AlmaLinux 8 receiving a custom backport due to architectural differences.

Why it matters

AlmaLinux's decision to ship ahead of RHEL upstream demonstrates growing downstream independence in the RHEL-compatible ecosystem and provides timely protection for multi-tenant and container-hosting environments where untrusted local code execution is a core threat model. System administrators running AlmaLinux in production should prioritize testing these kernels, as no practical mitigation exists beyond restricting shell access, and the vulnerability affects all supported releases with a well-understood exploitation path through standard socket APIs.