CVE-2026-74696
Received Received - Intake

TCP Fast Open Queue Accounting Flaw in Linux Kernel

Publication date: 2026-08-22

Last updated on: 2026-08-22

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reuseport migration A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SO_REUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one. fastopenq.qlen is charged in tcp_fastopen_create_child() when the child is created and uncharged in reqsk_fastopen_remove() when the handshake completes. The uncharge follows rsk_listener of the request the child points at, and inet_reqsk_clone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener's qlen drifts negative and its limit no longer binds. Charge the new listener during migration, like reqsk_queue_migrated() already does for queue->young and queue->qlen.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-22
Last Modified
2026-08-22
Generated
2026-08-22
AI Q&A
2026-08-22
EPSS Evaluated
N/A
NVD
CVE-2026-74696
EUVD
EUVD-2026-64383

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect accounting of TCP Fast Open (TFO) request limits when listener sockets are migrated using SO_REUSEPORT. Normally, a listener's max_qlen setting limits pending Fast Open requests, but during migration, the charge and discharge of these requests are miscalculated. This causes the new listener to accept more requests than configured, potentially leading to resource exhaustion or degraded performance.

Impact Analysis

If you run Linux systems with TCP Fast Open enabled and SO_REUSEPORT listener migration, this flaw could allow a listener to process more Fast Open requests than intended. This may lead to increased server load, potential denial-of-service conditions, or unexpected resource consumption on affected systems.

Mitigation Strategies

Update the Linux kernel to a patched version that includes the fix for CVE-2026-74696. This vulnerability is related to TCP Fast Open (TFO) and SO_REUSEPORT listener migration, so ensure your kernel version addresses the max_qlen accounting issue.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-74696. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart