{"id":"CVE-2026-99138","kind":"vulnerability","aliases":["CVE-2026-99138"],"related":[],"title":"Linux kernel: TCP getsockopt use-after-free with BPF congestion control","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)\n\ndo_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the\nget_info function pointer without rcu_read_lock(). With BPF struct_ops\ncongestion control, ca_ops can point to dynamically allocated memory\nthat is freed concurrently, resulting in a use-after-free when the\nkernel dereferences or calls through the stale pointer.\n\n  BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0\n  Read of size 8 at addr ffff888013701258 by task exploit/149\n   do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564)\n   tcp_getsockopt+0x91/0xf0\n   __sys_getsockopt+0xf7/0x170\n\nFix this by wrapping the ca_ops load and get_info call within\nrcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load\nthe icsk_ca_ops pointer.","summary":"The Linux kernel's TCP TCP_CC_INFO getsockopt path reads a congestion control ops pointer without RCU protection, so a BPF struct_ops congestion control module can be freed while still in use. The sources describe a use-after-free that can be triggered by a local process calling getsockopt, which may let an attacker crash the kernel or run code.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","runtime","self-hosted"],"not_affected_if":["default-config"],"how_to_check":"- `uname -r` and compare against the kernel version your distribution lists as fixed\n- Check whether BPF struct_ops TCP congestion control modules are loaded (unknown from sources)","fix":"- Update the Linux kernel to a release that includes the upstream commit 'tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)' (fixed versions unknown from sources)\n- Reboot into the patched kernel","status":"open","published_at":"2026-10-28T11:17:33+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:36:10+00:00","updated_at":"2026-10-28T11:36:10+00:00","category":"runtime","confidence":0.4,"triage":{"at":"2026-10-28T11:36:10Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Linux kernel to a release that includes the upstream commit 'tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)' (fixed versions unknown from sources)\n- Reboot into the patched kernel","reach":"local","title":"Linux kernel: TCP getsockopt use-after-free with BPF congestion control","impact":"high","summary":"The Linux kernel's TCP TCP_CC_INFO getsockopt path reads a congestion control ops pointer without RCU protection, so a BPF struct_ops congestion control module can be freed while still in use. The sources describe a use-after-free that can be triggered by a local process calling getsockopt, which may let an attacker crash the kernel or run code.","category":"runtime","nicknames":[],"who_cares":["linux","kernel","self-hosted"],"confidence":0.4,"needs_auth":"unknown","worst_case":"local process may crash the kernel or run code","analyst_note":"Check the kernel.org stable commit and the distribution advisories for affected and fixed kernel versions and the severity score.","how_to_check":"- `uname -r` and compare against the kernel version your distribution lists as fixed\n- Check whether BPF struct_ops TCP congestion control modules are loaded (unknown from sources)","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Systems running a Linux kernel with the affected TCP code path, particularly those that load BPF struct_ops TCP congestion control. Systems that do not use BPF congestion control are less exposed, but the sources do not say that they are fully unaffected. unknown beyond that.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000665,"input_tokens":3614,"output_tokens":608,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':176C,191C,197C,201C '-2026':14A,17A '-99138':15A,18A '/rcu_read_unlock':219C '4564':194C '8':181C 'addr':183C 'alloc':142C 'attack':81B 'bpf':10A,46B,131C 'bug':165C 'ca':117C,136C,208C,228C 'call':75B,160C,214C 'cc':31B,109C 'code':87B 'concurr':147C 'congest':11A,37B,49B,134C 'control':12A,38B,50B,135C 'crash':82B 'cve':13A,16A 'derefer':120C,158C 'describ':61B 'dynam':141C 'exploit/149':187C 'ffff888013701258':184C 'fix':99C,203C 'follow':93C 'free':8A,66B,103C,154C,171C 'freed':54B,146C 'function':124C 'get':122C,212C 'getsockopt':4A,33B,76B,107C,113C,175C,190C,196C,200C 'host':24B 'icsk':115C,116C,227C 'info':32B,110C,123C,213C 'kasan':166C 'kernel':2A,19B,27B,84B,91C,157C 'let':79B 'linux':1A,20B,26B,90C 'load':210C,225C 'local':73B 'lock':129C,218C 'may':78B 'memori':143C 'modul':51B 'net/ipv4/tcp.c':193C 'op':39B,48B,118C,133C,137C,209C,229C 'path':34B 'point':139C 'pointer':40B,125C,164C,230C 'process':74B 'protect':43B 'rcu':42B,127C,216C 'read':35B,114C,128C,178C,217C,222C 'resolv':97C 'result':148C 'run':86B 'runtim':21B 'self':23B 'self-host':22B 'size':180C 'slab':168C 'slab-use-after-fre':167C 'sourc':60B 'stale':163C 'still':56B 'struct':47B,132C 'sys':199C 'task':186C 'tcp':3A,29B,30B,98C,106C,108C,112C,174C,189C,195C 'trigger':70B 'use':6A,58B,64B,101C,152C,169C,221C 'use-after-fre':5A,63B,100C,151C 'vulner':94C 'within':215C 'without':41B,126C 'wrap':206C 'x2037/0x23e0':177C,192C 'x91/0xf0':198C 'xf7/0x170':202C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the affected TCP code path, particularly those that load BPF struct_ops TCP congestion control. Systems that do not use BPF congestion control are less exposed, but the sources do not say that they are fully unaffected. unknown beyond that.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99138","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99138","severity":null,"published_at":"2026-10-28T11:17:33+00:00","modified_at":"2026-10-28T11:17:33+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}