Live › vulnerability › CVE-2026-99138
Go to dashboardThe Linux kernel's TCP TCP_CC_INFO getsockopt path reads a congestion control ops pointer without RCU protection, so a BPF struct_ops congestion control module can be freed while still in use. The sources describe a use-after-free that can be triggered by a local process calling getsockopt, which may let an attacker crash the kernel or run code.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the affected TCP code path, particularly those that load BPF struct_ops TCP congestion control. Systems that do not use BPF congestion control are less exposed, but the sources do not say that they are fully unaffected. unknown beyond that.
No product ranges from the sources yet.
uname -r and compare against the kernel version your distribution lists as fixedEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the get_info function pointer without rcu_read_lock(). With BPF struct_ops congestion control, ca_ops can point to dynamically allocated memory that is freed concurrently, resulting in a use-after-free when the kernel dereferences or calls through the stale pointer.
BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0 Read of size 8 at addr ffff888013701258 by task exploit/149 do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564) tcp_getsockopt+0x91/0xf0 __sys_getsockopt+0xf7/0x170
Fix this by wrapping the ca_ops load and get_info call within rcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load the icsk_ca_ops pointer.
This page as .md · .json · in your agent: get_signal("CVE-2026-99138")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.