{"id":"CVE-2026-99139","kind":"vulnerability","aliases":["CVE-2026-99139"],"related":[],"title":"Linux kernel: TCP congestion control name read can use freed memory","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)\n\ndo_tcp_getsockopt() reads icsk->icsk_ca_ops->name without holding\nrcu_read_lock(). Since commit 0baf26b0fcd7 (\"bpf: tcp: Support\ntcp_congestion_ops in bpf\"), icsk_ca_ops can point to dynamically\nallocated BPF struct_ops memory that may be freed concurrently via\nsetsockopt(TCP_CONGESTION), leading to a use-after-free.\n\n  BUG: KASAN: slab-use-after-free in _copy_to_user+0x37/0x60\n  Read of size 16 at addr ffff888013505260 by task exploit/149\n   _copy_to_user+0x37/0x60\n   do_tcp_getsockopt+0x158a/0x2460 (net/ipv4/tcp.c:4585)\n   tcp_getsockopt+0x91/0xf0\n   __sys_getsockopt+0xf7/0x170\n\nFix this by holding rcu_read_lock() around the ca_ops->name access,\nusing READ_ONCE() to load icsk_ca_ops, and copying the name to a\nstack buffer before releasing the lock. Also annotate the relevant\nicsk_ca_ops stores with WRITE_ONCE() to fix the accompanying KCSAN\ndata-race issue.","summary":"A race in the Linux kernel's TCP getsockopt(TCP_CONGESTION) path reads a congestion control name after the BPF struct_ops memory behind it may already be freed. A local process can trigger a use-after-free read in kernel memory, which can leak data or crash the kernel.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["infrastructure","linux-kernel","multi-tenant","self-hosted"],"not_affected_if":["no-bpf-tcp-congestion-ops"],"how_to_check":"- unknown","fix":"- Update to a Linux kernel release that includes the upstream fix for tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) (versions unknown from the sources)","status":"open","published_at":"2026-10-28T11:17:33+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","triaged_at":"2026-10-28T11:36:08+00:00","updated_at":"2026-10-28T11:36:08+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-28T11:36:08Z","model":"claude-haiku-5-5","output":{"fix":"- Update to a Linux kernel release that includes the upstream fix for tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION) (versions unknown from the sources)","reach":"local","title":"Linux kernel: TCP congestion control name read can use freed memory","impact":"medium","summary":"A race in the Linux kernel's TCP getsockopt(TCP_CONGESTION) path reads a congestion control name after the BPF struct_ops memory behind it may already be freed. A local process can trigger a use-after-free read in kernel memory, which can leak data or crash the kernel.","category":"infrastructure","nicknames":[],"who_cares":["linux-kernel","self-hosted","multi-tenant"],"confidence":0.6,"needs_auth":"yes","worst_case":"local code reads freed kernel memory, possible crash or data leak","analyst_note":"Check the NVD entry and the upstream kernel stable commits for the fixed versions and the exact affected version range.","how_to_check":"- unknown","needs_analyst":true,"not_affected_if":["no-bpf-tcp-congestion-ops"],"who_is_affected":"Systems running a Linux kernel with the affected commit 0baf26b0fcd7 (BPF support for tcp_congestion_ops) and no fix. Exposure needs a local process able to call setsockopt and getsockopt on TCP sockets, and BPF struct_ops congestion control registered. Systems without BPF congestion control loaded are unlikely to hit the dynamically freed path, but the sources do not say this clearly.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000663,"input_tokens":3705,"output_tokens":585,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'+0':165C,180C,185C,191C,195C '-2026':13A,16A '-99139':14A,17A '0baf26b0fcd7':117C '16':170C '4585':188C 'access':209C 'accompani':244C 'addr':172C 'alloc':133C 'alreadi':54B 'also':230C 'annot':231C 'around':204C 'behind':51B 'bpf':47B,118C,125C,134C 'buffer':225C 'bug':154C 'ca':107C,127C,206C,216C,235C 'commit':116C 'concurr':142C 'congest':4A,38B,42B,100C,122C,146C 'control':5A,43B 'copi':162C,177C,219C 'crash':76B 'cve':12A,15A 'data':74B,247C 'data-rac':246C 'dynam':132C 'exploit/149':176C 'ffff888013505260':173C 'fix':90C,197C,242C 'follow':84C 'free':66B,94C,153C,160C 'freed':10A,56B,141C 'getsockopt':36B,98C,103C,184C,190C,194C 'hold':111C,200C 'host':27B 'icsk':105C,106C,126C,215C,234C 'infrastructur':18B 'issu':249C 'kasan':155C 'kcsan':245C 'kernel':2A,21B,33B,69B,78B,82C 'lead':147C 'leak':73B 'linux':1A,20B,32B,81C 'linux-kernel':19B 'load':214C 'local':58B 'lock':114C,203C,229C 'may':53B,139C 'memori':11A,50B,70B,137C 'multi':23B 'multi-ten':22B 'name':6A,44B,109C,208C,221C 'net/ipv4/tcp.c':187C 'op':49B,108C,123C,128C,136C,207C,217C,236C 'path':39B 'point':130C 'process':59B 'race':29B,248C 'rcu':112C,201C 'read':7A,40B,67B,104C,113C,167C,202C,211C 'releas':227C 'relev':233C 'resolv':88C 'self':26B 'self-host':25B 'setsockopt':144C 'sinc':115C 'size':169C 'slab':157C 'slab-use-after-fre':156C 'stack':224C 'store':237C 'struct':48B,135C 'support':120C 'sys':193C 'task':175C 'tcp':3A,35B,37B,89C,97C,99C,102C,119C,121C,145C,183C,189C 'tenant':24B 'trigger':61B 'use':9A,64B,92C,151C,158C,210C 'use-after-fre':63B,91C,150C 'user':164C,179C 'via':143C 'vulner':85C 'without':110C 'write':239C 'x158a/0x2460':186C 'x37/0x60':166C,181C 'x91/0xf0':192C 'xf7/0x170':196C","nicknames":[],"mitigations":[],"who_affected":"Systems running a Linux kernel with the affected commit 0baf26b0fcd7 (BPF support for tcp_congestion_ops) and no fix. Exposure needs a local process able to call setsockopt and getsockopt on TCP sockets, and BPF struct_ops congestion control registered. Systems without BPF congestion control loaded are unlikely to hit the dynamically freed path, but the sources do not say this clearly.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T11:17:33+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99139","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99139","severity":null,"published_at":"2026-10-28T11:17:33+00:00","modified_at":"2026-10-28T11:17:33+00:00","first_seen_at":"2026-10-28T11:32:35+00:00","fetched_at":"2026-10-28T11:32:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}