CVE-2026-99270
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in…
- Risk score
- 64/100
- CVSS
- 8.1 v3.1
- Published
- 3 Nov 2026
Open in the live forecast Today's forecast
What to know
- What it is
- A high-severity vulnerability in the Linux kernel's TCP implementation allows a potential use-after-free (UAF) attack. An attacker could exploit this to achieve high impact, including high confidentiality, integrity, and availability.
- Affected
- {'products': ['Linux kernel'], 'packages': [], 'versions': ['affected versions not specified']}
- Fix
- Check the linked advisory for affected versions and a fix.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 8.1 high
- Remotely exploitable without logging in
- On your watchlist: linux kernel
References
Original description
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free(). Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk's timer context, we can safely call timer_delete_sync() for the new reqsk. Let's pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk's timer.
Last activity 3 Nov 2026. Patch Forecast updates every hour.