{"id":"CVE-2026-99056","kind":"vulnerability","aliases":["CVE-2026-99056"],"related":[],"title":"Linux kernel: strparser race lets use-after-free in espintcp be exploited","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nstrparser: make sure __strp_recv isn't running before tearing down the parser\n\nThe comment above strp_done() claims that if strp is stopped,\nstrp_recv will no longer be called. That's only true if the caller has\na mechanism (eg locking) to guarantee that strp_recv() calls that\nstarted before strp_stop() have completed by the time we call\nstrp_done().\n\nThis adds a dummy lock_sock/release_sock pair to guarantee that any\nin-flight strp_recv() (which runs under either bh_lock_sock or\nlock_sock, depending if it's called from ->sk_data_ready or strp_work)\nhas completed.\n\nOnly espintcp can be affected by this race condition, but this patch\nmakes sure no future user of strp can have the bug.\n\nThis could crash on strp->sk (\"general mode\" of strp), but this mode\nhas been here for 9 years and has never been used. It'll be gone soon,\nno point worrying about it.\n\nSwitch the stopped/paused/etc bits to u8's to avoid races between\nstrp_stop() and strp_pause/unpause().\n\nA reproducer has been published and turns the possible UAF into an\nexploit [1].","summary":"A race in the Linux kernel's strparser stream parser can run a receive callback after the parser is torn down, causing a use-after-free. A published reproducer turns it into an exploit, per the advisory text.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["espintcp","linux-kernel","runtime"],"not_affected_if":["espintcp-unused"],"how_to_check":"- Run `uname -r` and compare against the fixed kernel versions listed by the distribution or NVD entry (unknown from these sources).\n- Check whether the espintcp module is loaded with `lsmod | grep espintcp`; only espintcp is named as affected.","fix":"- Update the Linux kernel to a release that includes the upstream strparser fix (fixed version: unknown from these sources).\n- Until patched, unload the espintcp module if it is not needed (unknown from these sources whether this fully mitigates).","status":"open","published_at":"2026-10-23T13:17:29+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","triaged_at":"2026-10-25T04:54:00+00:00","updated_at":"2026-10-25T04:54:00+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-10-25T04:54:00Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream strparser fix (fixed version: unknown from these sources).\n- Until patched, unload the espintcp module if it is not needed (unknown from these sources whether this fully mitigates).","reach":"local","title":"Linux kernel: strparser race lets use-after-free in espintcp be exploited","impact":"high","summary":"A race in the Linux kernel's strparser stream parser can run a receive callback after the parser is torn down, causing a use-after-free. A published reproducer turns it into an exploit, per the advisory text.","category":"runtime","nicknames":[],"who_cares":["linux-kernel","espintcp"],"confidence":0.5,"needs_auth":"unknown","worst_case":"local code could corrupt kernel memory and gain privileges","analyst_note":"Confirm affected and fixed kernel versions and whether a local attacker must already have access, from the NVD entry and the kernel stable commit.","how_to_check":"- Run `uname -r` and compare against the fixed kernel versions listed by the distribution or NVD entry (unknown from these sources).\n- Check whether the espintcp module is loaded with `lsmod | grep espintcp`; only espintcp is named as affected.","needs_analyst":true,"not_affected_if":["espintcp-unused"],"who_is_affected":"The sources say only espintcp can trigger this race, so systems that do not use espintcp are unlikely to be exposed. Hosts running custom kernels or distribution kernels that include espintcp should be checked; the sources do not describe other exposed configurations.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000653,"input_tokens":3607,"output_tokens":584,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':15A,18A '-99056':16A,19A '1':263C '9':217C 'add':138C 'advisori':62B 'affect':181C 'avoid':242C 'bh':157C 'bit':237C 'bug':199C 'call':104C,122C,134C,167C 'callback':39B 'caller':111C 'caus':46B 'claim':92C 'comment':88C 'complet':129C,176C 'condit':185C 'could':201C 'crash':202C 'cve':14A,17A 'data':170C 'depend':163C 'done':91C,136C 'dummi':140C 'eg':115C 'either':156C 'espintcp':11A,20B,178C 'exploit':13A,59B,262C 'flight':150C 'follow':69C 'free':9A,51B 'futur':192C 'general':206C 'gone':227C 'guarante':118C,145C 'in-flight':148C 'isn':79C 'kernel':2A,23B,30B,67C 'let':5A 'linux':1A,22B,29B,66C 'linux-kernel':21B 'll':225C 'lock':116C,141C,158C,161C 'longer':102C 'make':75C,189C 'mechan':114C 'mode':207C,212C 'never':221C 'pair':143C 'parser':34B,42B,86C 'patch':188C 'pause/unpause':249C 'per':60B 'point':230C 'possibl':258C 'publish':53B,254C 'race':4A,26B,184C,243C 'readi':171C 'receiv':38B 'recv':78C,99C,121C,152C 'reproduc':54B,251C 'resolv':73C 'run':36B,81C,154C 'runtim':24B 'sk':169C,205C 'sock':159C,162C 'sock/release_sock':142C 'soon':228C 'start':124C 'stop':97C,127C,246C 'stopped/paused/etc':236C 'stream':33B 'strp':77C,90C,95C,98C,120C,126C,135C,151C,173C,195C,204C,209C,245C,248C 'strparser':3A,32B,74C 'sure':76C,190C 'switch':234C 'tear':83C 'text':63B 'time':132C 'torn':44B 'true':108C 'turn':55B,256C 'u8':239C 'uaf':259C 'use':7A,49B,223C 'use-after-fre':6A,48B 'user':193C 'vulner':70C 'work':174C 'worri':231C 'year':218C","nicknames":[],"mitigations":[],"who_affected":"The sources say only espintcp can trigger this race, so systems that do not use espintcp are unlikely to be exposed. Hosts running custom kernels or distribution kernels that include espintcp should be checked; the sources do not describe other exposed configurations.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-23T13:17:29+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99056","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99056","severity":null,"published_at":"2026-10-23T13:17:29+00:00","modified_at":"2026-10-23T13:17:29+00:00","first_seen_at":"2026-10-23T21:57:33+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}