Live › vulnerability › CVE-2026-99139
Go to dashboardA race in the Linux kernel's TCP getsockopt(TCP_CONGESTION) path reads a congestion control name after the BPF struct_ops memory behind it may already be freed. A local process can trigger a use-after-free read in kernel memory, which can leak data or crash the kernel.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 11:32 UTC. All times on this page are UTC.
Systems running a Linux kernel with the affected commit 0baf26b0fcd7 (BPF support for tcp_congestion_ops) and no fix. Exposure needs a local process able to call setsockopt and getsockopt on TCP sockets, and BPF struct_ops congestion control registered. Systems without BPF congestion control loaded are unlikely to hit the dynamically freed path, but the sources do not say this clearly.
No product ranges from the sources yet.
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
do_tcp_getsockopt() reads icsk->icsk_ca_ops->name without holding rcu_read_lock(). Since commit 0baf26b0fcd7 ("bpf: tcp: Support tcp_congestion_ops in bpf"), icsk_ca_ops can point to dynamically allocated BPF struct_ops memory that may be freed concurrently via setsockopt(TCP_CONGESTION), leading to a use-after-free.
BUG: KASAN: slab-use-after-free in _copy_to_user+0x37/0x60 Read of size 16 at addr ffff888013505260 by task exploit/149 _copy_to_user+0x37/0x60 do_tcp_getsockopt+0x158a/0x2460 (net/ipv4/tcp.c:4585) tcp_getsockopt+0x91/0xf0 __sys_getsockopt+0xf7/0x170
Fix this by holding rcu_read_lock() around the ca_ops->name access, using READ_ONCE() to load icsk_ca_ops, and copying the name to a stack buffer before releasing the lock. Also annotate the relevant icsk_ca_ops stores with WRITE_ONCE() to fix the accompanying KCSAN data-race issue.
This page as .md · .json · in your agent: get_signal("CVE-2026-99139")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.