{"id":"CVE-2026-99270","kind":"vulnerability","aliases":["CVE-2026-99270"],"related":[],"title":"Linux kernel: TCP connection timer race lets memory be reused after free","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: Fix potential UAF in reqsk_timer_handler().\n\nWhen TCP socket migration fails at inet_ehash_insert() in\nreqsk_timer_handler(), we jump to the no_ownership: label\nand free the new reqsk immediately with __reqsk_free().\n\nThus, we must stop the new reqsk's timer before jumping to the\nlabel, but the timer might be missed since the cited commit,\nresulting in UAF.\n\nAs we are in the original reqsk's timer context, we can safely\ncall timer_delete_sync() for the new reqsk.\n\nLet's pass false to __inet_csk_reqsk_queue_drop() to stop\nthe new reqsk's timer.","summary":"When a TCP connection migration fails in the kernel's request-socket timer handler, the new request socket can be freed while its timer is still pending. A later timer firing then touches freed memory, which can crash the kernel or be turned into code execution.","severity":"unknown","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["kernel","linux","runtime","self-hosted","tcp"],"not_affected_if":["migration-disabled","older-kernel"],"how_to_check":"- `uname -r` and compare against the fixed kernel builds from your distribution\n- Check whether TCP socket migration (`net.ipv4.tcp_migrate_req`) is enabled: `sysctl net.ipv4.tcp_migrate_req`","fix":null,"status":"open","published_at":"2026-11-03T13:17:24+00:00","first_seen_at":"2026-11-03T13:20:53+00:00","triaged_at":"2026-11-03T13:21:49+00:00","updated_at":"2026-11-03T13:21:49+00:00","category":"runtime","confidence":0.5,"triage":{"at":"2026-11-03T13:21:49Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linux kernel: TCP connection timer race lets memory be reused after free","impact":"high","summary":"When a TCP connection migration fails in the kernel's request-socket timer handler, the new request socket can be freed while its timer is still pending. A later timer firing then touches freed memory, which can crash the kernel or be turned into code execution.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux","kernel","tcp","self-hosted"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"kernel memory corruption from a use-after-free, possibly code execution","analyst_note":"Confirm the fixed kernel versions and whether tcp_migrate_req is default-on, from the kernel.org stable commit or the NVD entry.","how_to_check":"- `uname -r` and compare against the fixed kernel builds from your distribution\n- Check whether TCP socket migration (`net.ipv4.tcp_migrate_req`) is enabled: `sysctl net.ipv4.tcp_migrate_req`","plain_action":"","needs_analyst":true,"not_affected_if":["older-kernel","migration-disabled"],"who_is_affected":"Any Linux host with a kernel that includes the cited commit can be exposed, since the bug sits in the generic TCP stack. Only hosts where TCP socket migration is in use reach the failing path; the sources do not say how commonly that is enabled by default. Systems that do not run this kernel version can skip it.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000714,"input_tokens":4272,"output_tokens":573,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2026':14A,17A '-99270':15A,18A 'call':160C 'cite':142C 'code':71B 'commit':143C 'connect':4A,29B 'context':156C 'crash':64B 'csk':174C 'cve':13A,16A 'delet':162C 'drop':177C 'ehash':98C 'execut':72B 'fail':31B,95C 'fals':171C 'fire':57B 'fix':84C 'follow':78C 'free':12A,112C,119C 'freed':47B,60B 'handler':40B,90C,103C 'host':24B 'immedi':116C 'inet':97C,173C 'insert':99C 'jump':105C,130C 'kernel':2A,19B,34B,66B,76C 'label':110C,133C 'later':55B 'let':7A,168C 'linux':1A,20B,75C 'memori':8A,61B 'might':137C 'migrat':30B,94C 'miss':139C 'must':122C 'new':42B,114C,125C,166C,181C 'origin':152C 'ownership':109C 'pass':170C 'pend':53B 'potenti':85C 'queue':176C 'race':6A 'reqsk':88C,101C,115C,118C,126C,153C,167C,175C,182C 'request':37B,43B 'request-socket':36B 'resolv':82C 'result':144C 'reus':10A 'runtim':21B 'safe':159C 'self':23B 'self-host':22B 'sinc':140C 'socket':38B,44B,93C 'still':52B 'stop':123C,179C 'sync':163C 'tcp':3A,25B,28B,83C,92C 'thus':120C 'timer':5A,39B,50B,56B,89C,102C,128C,136C,155C,161C,184C 'touch':59B 'turn':69B 'uaf':86C,146C 'vulner':79C","nicknames":[],"mitigations":[],"who_affected":"Any Linux host with a kernel that includes the cited commit can be exposed, since the bug sits in the generic TCP stack. Only hosts where TCP socket migration is in use reach the failing path; the sources do not say how commonly that is enabled by default. Systems that do not run this kernel version can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["kernel","linux","runtime","selfhosted","tcp","unknown"],"first_public_at":"2026-11-03T13:17:24+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99270","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99270","severity":null,"published_at":"2026-11-03T13:17:24+00:00","modified_at":"2026-11-03T13:17:24+00:00","first_seen_at":"2026-11-03T13:20:53+00:00","fetched_at":"2026-11-03T13:20:53+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}