tcp: Fix potential UAF in reqsk_timer_handler().
Affects Linux kernel versions from 4.1.11 up to 4.2, when TCP socket migration fails at inet_ehash_insert() inside reqsk_timer_handler(). The CVSS score is 8.1 (high).
Written by anthropic/claude-haiku-5.5 from the sources below. Verify against them.
- Exploited
- No known exploitation
- Fix
- Fixed in 4.2
- Who is exposed
- Not reported
Do first: Upgrade to a fixed version: 4.2.
- Exploitation?/40Exploitation: unknown (data gap). No CISA SSVC exploitation rating yet
- Exposure17/25No login or user action needed, reachable over the network without a login · Data gap: Advisories don't say whether default setups are affected
- Reach20/20Affects Linux kernel (software on nearly every server, desktop or phone)
- Severity8.1/10CVSS 8.1
- No patch0/5No signal
What would change the score
- Would score about 90 if added to CISA KEV
- Would score about 85 if CISA's SSVC rates exploitation active
- Would score about 50 if advisories confirm default setups are exposed
CVE-2026-99270 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.1 (high) and affects Linux; fixed in 4.2.
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- Published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- A 0-100 score for how much a CVE matters across the industry: exploitation, exposure, how widely the software is used, severity and whether a fix exists.What do these mean? →
- 45/100 · provisional
- How many real-world setups can hit the bug, from the vendor's advisory and CISA data. It does not know your setup.What do these mean? →
- Unclear
- Fix
- Fixed in 4.2
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
The Linux kernel's TCP implementation is affected, specifically the code that handles connection request timers during TCP socket migration. A failed migration could leave a request socket's timer running after the socket is freed, which can lead to a use-after-free condition and potential memory corruption or crash.
Read the original description
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free(). Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk's timer context, we can safely call timer_delete_sync() for the new reqsk. Let's pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk's timer.
What to do
Upgrade to a fixed version: 4.2.
Timeline
- CVE published
- First seen by cve.now
- Record last updated
- Posted on X by cve.now
Affected versions
- Linux Linux
From 4.1.11 · fixed in 4.2
- Linux Linux
4.2
Evidence 1
- Link
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about CVE-2026-99270
Is CVE-2026-99270 being exploited?
It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.Source: cve.now feed data
What does this mean?
When TCP socket migration fails at inet_ehash_insert(), the timer of the new request socket may not be stopped before the socket is freed. The timer handler can then use that freed socket, which is a use-after-free.Source: git.kernel.org
Which versions are affected by CVE-2026-99270?
Linux: from 4.1.11 before 4.2. Linux: version 4.2.Source: cve.now feed data
Am I affected, and how do I check?
The listed range is Linux kernel 4.1.11 up to but not including 4.2. To check a system, run uname -r to see the running kernel version. The problem only arises in the TCP socket migration failure path at inet_ehash_insert().Source: git.kernel.org
How do I fix CVE-2026-99270?
Move to a Linux kernel at or above 4.2, which is the listed fixed version. The facts do not describe a separate workaround.Source: git.kernel.org