{"id":"CVE-2026-99288","kind":"vulnerability","aliases":["CVE-2026-99288"],"related":[],"title":"Linux kernel: TCP lookup can return a reused socket and crash","description":"In the Linux kernel, the following vulnerability has been resolved:\n\ninet: reject unhashed sockets during established lookups\n\nTCP established ehash lookups are lockless. The socket caches involved\nuse SLAB_TYPESAFE_BY_RCU, so memory can be reused before an RCU reader\nthat retained its old address has finished.\n\nAfter a tuple match, __inet_lookup_established() and\n__inet6_lookup_established() acquire a reference and repeat the tuple\ncheck. They do not check whether the new object is hashed. If the\naddress is reused for a socket with the same tuple, the lookup can\nacquire a reference to the new object and return it while its nulls node\nis unhashed.\n\nA PoC that drives reuse with a SYN cookie request socket reproduced the\ncrash. The new request socket is unhashed and has a NULL rsk_listener.\nA lookup that had loaded the address of the old request socket acquired\nthe reference published by tcp_get_cookie_sock() and returned the new\nobject. tcp_v4_rcv() then read sk_state through the NULL listener.\n\nThe resulting crash was:\n\n  BUG: kernel NULL pointer dereference, address: 0000000000000012\n  #PF: supervisor read access in kernel mode\n  #PF: error_code(0x0000) - not-present page\n  ...\n  Oops: Oops: 0000 [#1] SMP NOPTI\n  CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 7.3.0-00591-g0e135910deec #1 PREEMPT(lazy)\n  ...\n  RIP: 0010:tcp_v4_rcv+0x44e/0x1280\n  ...\n  R10: 0000000000000001 R11: 00000000024ca8c0 R12: 0000000000000000\n  ...\n  CR2: 0000000000000012 CR3: 0000000103d50004 CR4: 0000000000770ef0\n  ...\n  Call Trace:\n   <IRQ>\n   ? raw_local_deliver+0xae/0x240\n   ip_protocol_deliver_rcu+0x2d/0x180\n   ip_local_deliver_finish+0x84/0x100\n   ip_sublist_rcv_finish+0x5f/0x70\n   ip_sublist_rcv+0x12a/0x1d0\n   ip_list_rcv+0xfd/0x130\n   __netif_receive_skb_list_core+0x223/0x250\n   netif_receive_skb_list_internal+0x1d2/0x2c0\n   ? try_fill_recv+0x39/0x7b0\n   napi_complete_done+0x74/0x170\n   virtnet_poll+0x445/0x600\n   __napi_poll+0x27/0x1e0\n   net_rx_action+0x2fe/0x3b0\n   handle_softirqs+0xc2/0x2c0\n   __irq_exit_rcu+0x74/0xd0\n   common_interrupt+0x7f/0x90\n   </IRQ>\n  ...\n  Kernel panic - not syncing: Fatal exception in interrupt\n\nAfter taking a reference, check whether the nulls node is unhashed in\nboth IPv4 and IPv6 established lookups. If it is unhashed or the tuple\nno longer matches, drop the reference and restart the lookup.\n\nLookups racing with the TIME_WAIT hashdance, or with a request being\nreplaced by its child, now restart and find the new socket instead of\nreturning the old one.\n\nRequest sockets that were never inserted into ehash can have a nonzero\nrefcount, and a stale lookup can hold a transient reference. Therefore,\nwhen SYN cookie, Fast Open, and request migration paths fail after\nsetting a nonzero refcount, release the references held by those paths\nwith reqsk_put() instead of freeing the request directly.","summary":"A race in the Linux kernel's TCP established-socket lookup can return a recycled socket that is no longer hashed, so the kernel reads a NULL listener pointer. The result is a kernel NULL pointer dereference and a crash (kernel panic) when a crafted SYN cookie request socket is reused.","severity":"high","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"linux-kernel","fixed":["6.12.117","6.18.63","7.3.4"],"affected":">= 4.4, < 6.12.117; >= 6.13, < 6.18.63; >= 6.19, < 7.3.4","ecosystem":"linux"}],"ecosystems":[],"tags":["kernel","linux","runtime","servers","tcp"],"not_affected_if":[],"how_to_check":"Run uname -r. Vulnerable if running a mainline/stable kernel from 4.4 up to before 6.12.117, 6.18.63 or 7.3.4 on the matching branch. Distro kernels backport fixes, so compare against your distribution's advisory/changelog for CVE-2026-99288 rather than the version number alone. Also check branches not listed in the CVE record (e.g. 5.x, 6.1, 6.6): affected from 4.4, but no fix version was published for them as of this record.","fix":"Upgrade to a kernel with the fix: 6.12.117 or later (6.12 branch), 6.18.63 or later (6.18 branch), 7.3.4 or later (7.3 branch). For other branches (5.x, 6.1, 6.6, etc.), use your distribution's patched kernel package; the CVE record lists no fixed version for them.","status":"open","published_at":"2026-11-10T19:22:32+00:00","first_seen_at":"2026-11-10T19:25:35+00:00","triaged_at":"2026-11-10T20:04:40+00:00","updated_at":"2026-11-10T20:05:56+00:00","category":"runtime","confidence":0.8,"triage":{"at":"2026-11-10T20:04:40Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Linux kernel: TCP lookup can return a reused socket and crash","impact":"high","summary":"A race in the Linux kernel's TCP established-socket lookup can return a recycled socket that is no longer hashed, so the kernel reads a NULL listener pointer. The result is a kernel NULL pointer dereference and a crash (kernel panic) when a crafted SYN cookie request socket is reused.","audience":"businesses","category":"runtime","nicknames":[],"who_cares":["linux","kernel","tcp","servers"],"confidence":0.6,"fix_status":"unknown","needs_auth":"no","worst_case":"remote crash of the kernel via crafted network packets","analyst_note":"Find the fixed kernel versions per stable branch and the distribution advisories for CVE-2026-99288 from the NVD entry and kernel.org stable commits.","how_to_check":"- Run `uname -r` and compare the kernel version against the fixed kernel versions in the upstream stable branch for your release line.\n- Check whether your distribution has shipped a kernel package that includes this fix (unknown from the sources).","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":[],"who_is_affected":"Any Linux host that accepts incoming TCP connections over IPv4 or IPv6 can reach the vulnerable code path, since the lookup runs on received packets. Hosts that do not run a kernel with this change, and the sources do not give a version range, cannot be ruled out. unknown beyond that.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000854,"input_tokens":5714,"output_tokens":565,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Find the fixed kernel versions per stable branch and the distribution advisories for CVE-2026-99288 from the NVD entry and kernel.org stable commits.","search":"'+0':302C,321C,327C,333C,339C,344C,349C,356C,363C,368C,373C,377C,381C,386C,390C,395C,399C '-00591':292C '-2026':13A,16A '-99288':14A,17A '0':284C,286C '0000':277C '0000000000000000':309C '0000000000000001':305C '0000000000000012':259C,311C '0000000000770ef0':315C '00000000024ca8c0':307C '0000000103d50004':313C '0010':298C '0x0000':270C '1':278C,294C '4':282C '7.3.0':291C 'access':263C 'acquir':137C,170C,224C 'action':385C 'address':123C,157C,218C,258C 'bug':253C 'cach':103C 'call':316C 'check':144C,148C,413C 'child':459C 'code':269C 'comm':287C 'common':397C 'complet':371C 'cooki':73B,194C,231C,498C 'core':355C 'cpu':281C 'cr2':310C 'cr3':312C 'cr4':314C 'craft':71B 'crash':11A,66B,199C,251C 'cve':12A,15A 'deliv':320C,325C,331C 'derefer':63B,257C 'direct':526C 'done':372C 'drive':189C 'drop':437C 'ehash':97C,480C 'error':268C 'establish':35B,93C,96C,132C,136C,425C 'established-socket':34B 'except':406C 'exit':393C 'fail':505C 'fast':499C 'fatal':405C 'fill':366C 'find':463C 'finish':125C,332C,338C 'follow':83C 'free':523C 'g0e135910deec':293C 'get':230C 'handl':388C 'hash':47B,154C 'hashdanc':450C 'held':514C 'hold':491C 'inet':88C,130C 'inet6':134C 'insert':478C 'instead':467C,521C 'intern':362C 'interrupt':398C,408C 'involv':104C 'ip':323C,329C,335C,341C,346C 'ipv4':422C 'ipv6':424C 'irq':392C 'kernel':2A,20A,21B,31B,50B,60B,67B,81C,254C,265C,401C 'lazi':296C 'linux':1A,19A,22B,30B,80C 'linux-kernel':18A 'list':347C,354C,361C 'listen':54B,211C,248C 'load':216C 'local':319C,330C 'lockless':100C 'longer':46B,435C 'lookup':4A,37B,94C,98C,131C,135C,168C,213C,426C,443C,444C,489C 'match':129C,436C 'memori':111C 'migrat':503C 'mode':266C 'napi':370C,379C 'net':383C 'netif':351C,358C 'never':477C 'new':151C,175C,201C,236C,465C 'node':183C,417C 'nonzero':484C,509C 'nopti':280C 'not-pres':271C 'null':53B,61B,182C,209C,247C,255C,416C 'object':152C,176C,237C 'old':122C,221C,471C 'one':472C 'oop':275C,276C 'open':500C 'page':274C 'panic':68B,402C 'path':504C,517C 'pf':260C,267C 'pid':285C 'poc':187C 'pointer':55B,62B,256C 'poll':376C,380C 'preempt':295C 'present':273C 'protocol':324C 'publish':227C 'put':520C 'r10':304C 'r11':306C 'r12':308C 'race':27B,445C 'raw':318C 'rcu':109C,117C,326C,394C 'rcv':240C,301C,337C,343C,348C 'read':51B,242C,262C 'reader':118C 'receiv':352C,359C 'recv':367C 'recycl':41B 'refcount':485C,510C 'refer':139C,172C,226C,412C,439C,494C,513C 'reject':89C 'releas':511C 'repeat':141C 'replac':456C 'reproduc':197C 'reqsk':519C 'request':74B,195C,202C,222C,454C,473C,502C,525C 'resolv':87C 'restart':441C,461C 'result':57B,250C 'retain':120C 'return':6A,39B,178C,234C,469C 'reus':8A,77B,114C,159C,190C 'rip':297C 'rsk':210C 'runtim':23B 'rx':384C 'server':24B 'set':507C 'sk':243C 'skb':353C,360C 'slab':106C 'smp':279C 'sock':232C 'socket':9A,36B,42B,75B,91C,102C,162C,196C,203C,223C,466C,474C 'softirq':389C 'stale':488C 'state':244C 'sublist':336C,342C 'supervisor':261C 'swapper/4':288C 'syn':72B,193C,497C 'sync':404C 'taint':290C 'take':410C 'tcp':3A,25B,33B,95C,229C,238C,299C 'therefor':495C 'time':448C 'trace':317C 'transient':493C 'tri':365C 'tupl':128C,143C,166C,433C 'typesaf':107C 'uid':283C 'unhash':90C,185C,205C,419C,430C 'use':105C 'v4':239C,300C 'virtnet':375C 'vulner':84C 'wait':449C 'whether':149C,414C 'x12a/0x1d0':345C 'x1d2/0x2c0':364C 'x223/0x250':357C 'x27/0x1e0':382C 'x2d/0x180':328C 'x2fe/0x3b0':387C 'x39/0x7b0':369C 'x445/0x600':378C 'x44e/0x1280':303C 'x5f/0x70':340C 'x74/0x170':374C 'x74/0xd0':396C 'x7f/0x90':400C 'x84/0x100':334C 'xae/0x240':322C 'xc2/0x2c0':391C 'xfd/0x130':350C","nicknames":[],"mitigations":[],"who_affected":"Any Linux host that accepts TCP connections over IPv4 or IPv6 runs the vulnerable lookup, on kernels from 4.4 before the fixed releases (6.12.117, 6.18.63, 7.3.4). The reported impact is a kernel NULL pointer dereference and panic (denial of service); the kernel's PoC used a SYN cookie request socket. No exploitation in the wild or privilege escalation is reported. Distribution kernels backport, so check your vendor advisory.","tier":"B","verified":{"fix":{"at":"2026-11-10T20:05:56Z","by":"analyst","doc":"https://lists.openwall.net/netdev/2026/10/23/74","run_id":2605},"how_to_check":{"at":"2026-11-10T20:05:56Z","by":"analyst","doc":"https://lists.openwall.net/netdev/2026/10/23/74","run_id":2605}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["linuxkernel"],"ptokens":["kernel","linux"],"labels":["high","kernel","linux","runtime","servers","tcp"],"campaign_type":null,"search_a":"'-2026':13A,16A '-99288':14A,17A 'crash':11A 'cve':12A,15A 'kernel':2A,20A 'linux':1A,19A 'linux-kernel':18A 'lookup':4A 'return':6A 'reus':8A 'socket':9A 'tcp':3A","search_b":"'cooki':73B 'craft':71B 'crash':66B 'derefer':63B 'establish':35B 'established-socket':34B 'hash':47B 'kernel':21B,31B,50B,60B,67B 'linux':22B,30B 'listen':54B 'longer':46B 'lookup':37B 'null':53B,61B 'panic':68B 'pointer':55B,62B 'race':27B 'read':51B 'recycl':41B 'request':74B 'result':57B 'return':39B 'reus':77B 'runtim':23B 'server':24B 'socket':36B,42B,75B 'syn':72B 'tcp':25B,33B","search_c":"'+0':302C,321C,327C,333C,339C,344C,349C,356C,363C,368C,373C,377C,381C,386C,390C,395C,399C '-00591':292C '0':284C,286C '0000':277C '0000000000000000':309C '0000000000000001':305C '0000000000000012':259C,311C '0000000000770ef0':315C '00000000024ca8c0':307C '0000000103d50004':313C '0010':298C '0x0000':270C '1':278C,294C '4':282C '7.3.0':291C 'access':263C 'acquir':137C,170C,224C 'action':385C 'address':123C,157C,218C,258C 'bug':253C 'cach':103C 'call':316C 'check':144C,148C,413C 'child':459C 'code':269C 'comm':287C 'common':397C 'complet':371C 'cooki':194C,231C,498C 'core':355C 'cpu':281C 'cr2':310C 'cr3':312C 'cr4':314C 'crash':199C,251C 'deliv':320C,325C,331C 'derefer':257C 'direct':526C 'done':372C 'drive':189C 'drop':437C 'ehash':97C,480C 'error':268C 'establish':93C,96C,132C,136C,425C 'except':406C 'exit':393C 'fail':505C 'fast':499C 'fatal':405C 'fill':366C 'find':463C 'finish':125C,332C,338C 'follow':83C 'free':523C 'g0e135910deec':293C 'get':230C 'handl':388C 'hash':154C 'hashdanc':450C 'held':514C 'hold':491C 'inet':88C,130C 'inet6':134C 'insert':478C 'instead':467C,521C 'intern':362C 'interrupt':398C,408C 'involv':104C 'ip':323C,329C,335C,341C,346C 'ipv4':422C 'ipv6':424C 'irq':392C 'kernel':81C,254C,265C,401C 'lazi':296C 'linux':80C 'list':347C,354C,361C 'listen':211C,248C 'load':216C 'local':319C,330C 'lockless':100C 'longer':435C 'lookup':94C,98C,131C,135C,168C,213C,426C,443C,444C,489C 'match':129C,436C 'memori':111C 'migrat':503C 'mode':266C 'napi':370C,379C 'net':383C 'netif':351C,358C 'never':477C 'new':151C,175C,201C,236C,465C 'node':183C,417C 'nonzero':484C,509C 'nopti':280C 'not-pres':271C 'null':182C,209C,247C,255C,416C 'object':152C,176C,237C 'old':122C,221C,471C 'one':472C 'oop':275C,276C 'open':500C 'page':274C 'panic':402C 'path':504C,517C 'pf':260C,267C 'pid':285C 'poc':187C 'pointer':256C 'poll':376C,380C 'preempt':295C 'present':273C 'protocol':324C 'publish':227C 'put':520C 'r10':304C 'r11':306C 'r12':308C 'race':445C 'raw':318C 'rcu':109C,117C,326C,394C 'rcv':240C,301C,337C,343C,348C 'read':242C,262C 'reader':118C 'receiv':352C,359C 'recv':367C 'refcount':485C,510C 'refer':139C,172C,226C,412C,439C,494C,513C 'reject':89C 'releas':511C 'repeat':141C 'replac':456C 'reproduc':197C 'reqsk':519C 'request':195C,202C,222C,454C,473C,502C,525C 'resolv':87C 'restart':441C,461C 'result':250C 'retain':120C 'return':178C,234C,469C 'reus':114C,159C,190C 'rip':297C 'rsk':210C 'rx':384C 'set':507C 'sk':243C 'skb':353C,360C 'slab':106C 'smp':279C 'sock':232C 'socket':91C,102C,162C,196C,203C,223C,466C,474C 'softirq':389C 'stale':488C 'state':244C 'sublist':336C,342C 'supervisor':261C 'swapper/4':288C 'syn':193C,497C 'sync':404C 'taint':290C 'take':410C 'tcp':95C,229C,238C,299C 'therefor':495C 'time':448C 'trace':317C 'transient':493C 'tri':365C 'tupl':128C,143C,166C,433C 'typesaf':107C 'uid':283C 'unhash':90C,185C,205C,419C,430C 'use':105C 'v4':239C,300C 'virtnet':375C 'vulner':84C 'wait':449C 'whether':149C,414C 'x12a/0x1d0':345C 'x1d2/0x2c0':364C 'x223/0x250':357C 'x27/0x1e0':382C 'x2d/0x180':328C 'x2fe/0x3b0':387C 'x39/0x7b0':369C 'x445/0x600':378C 'x44e/0x1280':303C 'x5f/0x70':340C 'x74/0x170':374C 'x74/0xd0':396C 'x7f/0x90':400C 'x84/0x100':334C 'xae/0x240':322C 'xc2/0x2c0':391C 'xfd/0x130':350C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:22:32+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-99288","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99288","severity":null,"published_at":"2026-11-10T19:22:32+00:00","modified_at":"2026-11-10T19:22:32+00:00","first_seen_at":"2026-11-10T19:25:35+00:00","fetched_at":"2026-11-10T19:25:35+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-99288:2605","url":"https://cveawg.mitre.org/api/cve/CVE-2026-99288","severity":null,"published_at":"2026-11-10T20:05:56+00:00","modified_at":"2026-11-10T20:05:56+00:00","first_seen_at":"2026-11-10T20:05:56+00:00","fetched_at":"2026-11-10T20:05:56+00:00","note":"Fixed versions from the kernel.org CNA CVE record (6.12.117, 6.18.63, 7.3.4); git.kernel.org commit pages blocked by Anubis, so commit-to-branch mapping is from the CVE record only. Distro advisories not found yet. Not exploited per sources; severity unchanged. Version ranges between listed branches are my reading of the CNA's semver entries.","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-99288","https://lists.openwall.net/netdev/2026/10/23/74"]}],"documents":[{"id":117773,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-99288","title":"CVE-2026-99288 CVE record (kernel.org CNA)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":117774,"url":"https://lists.openwall.net/netdev/2026/10/23/74","title":"[PATCH net v2 1/2] inet: reject unhashed sockets during established lookups","kind":"issue","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}