CVE-2026-99270High· 8.1▾ TwilightIn the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label an…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 44.6 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via CVEORG
0.3%
In the Linux kernel, the following vulnerability has been resolved:
tcp: Fix potential UAF in reqsk_timer_handler().
When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free().
Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF.
As we are in the original reqsk's timer context, we can safely call timer_delete_sync() for the new reqsk.
Let's pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk's timer.
Linux >= 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af < 97c8a3c1f73d828de43a5a88e8a9a143efb2b661Linux d3a1196bfc462943694623412d8e03aaf172bdc1Linux >= 4.1.11 < 4.2Linux 4.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-99253Noneio_uring/cancel: rearm local work wake up before sleep
CVE-2026-99269High· 7.8sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
CVE-2026-99246High· 8.1tipc: protect node reset trace dump with node lock
CVE-2026-99261Nonedrm/amdgpu: correct reservation fence slots for userq per-vm BOs eviction
CVE-2026-99260Nonentfs: fix resident conversion in ntfs_new_attr_flags
CVE-2026-99255Noneio_uring/io-wq: don't hide a link from cancellations