---
id: CVE-2026-99138
title: 'tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)

  do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the
  get_info function pointer without rcu_read_l…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 <
    86814e5370068ec2bf0caa6e6d55c3e5bfc6c324
  - >-
    Linux >= 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 <
    39aa489e85752f9de214edb0f85e4d578e57af29
  - >-
    Linux >= 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 <
    385e474086c2e7e29e2dded690be40dc273e20ee
  - Linux 5.6
published: '2026-10-28'
updated: '2026-10-28'
sourceUpdated: '2026-10-28T10:34:49.993Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-99138'
references:
  - url: 'https://git.kernel.org/stable/c/86814e5370068ec2bf0caa6e6d55c3e5bfc6c324'
  - url: 'https://git.kernel.org/stable/c/39aa489e85752f9de214edb0f85e4d578e57af29'
  - url: 'https://git.kernel.org/stable/c/385e474086c2e7e29e2dded690be40dc273e20ee'
tags:
  - cve.org
ingestedAt: '2026-10-28T11:09:40.430Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)

do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the
get_info function pointer without rcu_read_lock(). With BPF struct_ops
congestion control, ca_ops can point to dynamically allocated memory
that is freed concurrently, resulting in a use-after-free when the
kernel dereferences or calls through the stale pointer.

  BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0
  Read of size 8 at addr ffff888013701258 by task exploit/149
   do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564)
   tcp_getsockopt+0x91/0xf0
   __sys_getsockopt+0xf7/0x170

Fix this by wrapping the ca_ops load and get_info call within
rcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load
the icsk_ca_ops pointer.

## Affected

- `Linux >= 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 < 86814e5370068ec2bf0caa6e6d55c3e5bfc6c324`
- `Linux >= 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 < 39aa489e85752f9de214edb0f85e4d578e57af29`
- `Linux >= 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 < 385e474086c2e7e29e2dded690be40dc273e20ee`
- `Linux 5.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.