---
id: "CVE-2026-99270"
kind: "vulnerability"
aliases: ["CVE-2026-99270"]
title: "Linux kernel: TCP connection timer race lets memory be reused after free"
severity: "unknown"
cvss: null
epss: null
exploited: false
status: "open"
category: "runtime"
products: []
ecosystems: []
tags: ["kernel", "linux", "runtime", "self-hosted", "tcp"]
not_affected_if: ["migration-disabled", "older-kernel"]
published_at: "2026-11-03T13:17:24+00:00"
first_seen_at: "2026-11-03T13:20:53+00:00"
updated_at: "2026-11-03T13:21:49+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-99270", "first_seen_at": "2026-11-03T13:20:53+00:00"}]
---

# Linux kernel: TCP connection timer race lets memory be reused after free

When a TCP connection migration fails in the kernel's request-socket timer handler, the new request socket can be freed while its timer is still pending. A later timer firing then touches freed memory, which can crash the kernel or be turned into code execution.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- `uname -r` and compare against the fixed kernel builds from your distribution
- Check whether TCP socket migration (`net.ipv4.tcp_migrate_req`) is enabled: `sysctl net.ipv4.tcp_migrate_req`

## Timeline

- 2026-11-03T13:20:53+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-99270

## From the sources

In the Linux kernel, the following vulnerability has been resolved:

tcp: Fix potential UAF in reqsk_timer_handler().

When TCP socket migration fails at inet_ehash_insert() in
reqsk_timer_handler(), we jump to the no_ownership: label
and free the new reqsk immediately with __reqsk_free().

Thus, we must stop the new reqsk's timer before jumping to the
label, but the timer might be missed since the cited commit,
resulting in UAF.

As we are in the original reqsk's timer context, we can safely
call timer_delete_sync() for the new reqsk.

Let's pass false to __inet_csk_reqsk_queue_drop() to stop
the new reqsk's timer.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_