All vulnerabilities
CVE-2026-99138

Linux: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
Fixed in86814e5370068ec2bf0caa6e6d55c3e5bfc6c324Also 39aa489e85752f9de214edb0f85e4d578e57af29, 385e474086c2e7e29e2dded690be40dc273e20eeCVE List
Published28 Oct 2026Updated 28 Oct 2026CVE List

What fixes it

  • 86814e5370068ec2bf0caa6e6d55c3e5bfc6c324LinuxCVE List
  • 39aa489e85752f9de214edb0f85e4d578e57af29LinuxCVE List
  • 385e474086c2e7e29e2dded690be40dc273e20eeLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)

do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the get_info function pointer without rcu_read_lock(). With BPF struct_ops congestion control, ca_ops can point to dynamically allocated memory that is freed concurrently, resulting in a use-after-free when the kernel dereferences or calls through the stale pointer.

BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0 Read of size 8 at addr ffff888013701258 by task exploit/149 do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564) tcp_getsockopt+0x91/0xf0 __sys_getsockopt+0xf7/0x170

Fix this by wrapping the ca_ops load and get_info call within rcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load the icsk_ca_ops pointer.

Text from CVE List

Affected versions 8

  • Linuxaffected: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 before 86814e5370068ec2bf0caa6e6d55c3e5bfc6c324CVE List
  • Linuxaffected: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 before 39aa489e85752f9de214edb0f85e4d578e57af29CVE List
  • Linuxaffected: 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 before 385e474086c2e7e29e2dded690be40dc273e20eeCVE List
  • Linuxaffected: 5.6CVE List
  • Linuxunaffected: all versions before 5.6CVE List
  • Linuxunaffected: 6.18.59 through 6.18.*CVE List
  • Linuxunaffected: 7.2.13 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 3