CVE-2026-99270
Received Received - Intake

Use-After-Free in Linux Kernel TCP Socket Migration

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free(). Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk's timer context, we can safely call timer_delete_sync() for the new reqsk. Let's pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk's timer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-99270
EUVD
EUVD-2026-115811

Affected Vendors & Products

Showing 4 associated CPEs
Vendor Product Version / Range
Linux Linux 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af
Linux Linux d3a1196bfc462943694623412d8e03aaf172bdc1
Linux Linux 4.1.11
Linux Linux 4.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a use-after-free (UAF) issue in the Linux kernel's TCP socket handling. It occurs in the reqsk_timer_handler() function when socket migration fails. The timer for a new request socket might not be stopped properly, leading to a use-after-free scenario where memory is accessed after it has been freed.

Detection Guidance

This vulnerability is specific to the Linux kernel's TCP socket handling and requires kernel-level inspection. Detection involves checking kernel logs for related errors or using tools like 'dmesg' to identify crashes or unusual behavior in TCP socket operations. No direct commands are provided in the context to detect this issue.

Impact Analysis

This vulnerability could allow an attacker to cause a denial-of-service (DoS) condition or potentially execute arbitrary code with kernel privileges. It may lead to system crashes or instability if exploited.

Mitigation Strategies

Apply the latest Linux kernel patches or updates that address this issue. Since the vulnerability is resolved in a specific kernel version, updating to a patched version is the primary mitigation step. Monitor vendor advisories for kernel updates.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-99270. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...