CVE-2026-99138

tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)

State: Published
Severity: Not scored
Published: Oct 28, 2026
Updated: Oct 30, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)

do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the get_info function pointer without rcu_read_lock(). With BPF struct_ops congestion control, ca_ops can point to dynamically allocated memory that is freed concurrently, resulting in a use-after-free when the kernel dereferences or calls through the stale pointer.

BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0 Read of size 8 at addr ffff888013701258 by task exploit/149 do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564) tcp_getsockopt+0x91/0xf0 __sys_getsockopt+0xf7/0x170

Fix this by wrapping the ca_ops load and get_info call within rcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load the icsk_ca_ops pointer.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before 7c312f17917455eedcea29735fa302ebb93cb9b9Affected 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before 66b831b427301a9c3e485564009d476631413103Affected 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before a8b024cbf62b497062c86995737fc303e4cc384eAffected 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before 8d5fc9e6dc09174d0da6e59678eb8e01a890cbd3Affected 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before e057d201640eebb8ed47ec924872c41570a3bd28Affected 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before 86814e5370068ec2bf0caa6e6d55c3e5bfc6c324Affected 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before 39aa489e85752f9de214edb0f85e4d578e57af29Affected 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before 385e474086c2e7e29e2dded690be40dc273e20eeAffected
LinuxLinux	5.6Affected before 5.6Not affected 5.10.273 through 5.10.Not affected 5.15.224 through 5.15.Not affected 6.1.191 through 6.1.Not affected 6.6.161 through 6.6.Not affected 6.12.115 through 6.12.Not affected 6.18.59 through 6.18.Not affected 7.2.13 through 7.2.*Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before 7c312f17917455eedcea29735fa302ebb93cb9b9Affected
0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before 66b831b427301a9c3e485564009d476631413103Affected
0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before a8b024cbf62b497062c86995737fc303e4cc384eAffected
0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before 8d5fc9e6dc09174d0da6e59678eb8e01a890cbd3Affected
0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before e057d201640eebb8ed47ec924872c41570a3bd28Affected
0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before 86814e5370068ec2bf0caa6e6d55c3e5bfc6c324Affected
0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before 39aa489e85752f9de214edb0f85e4d578e57af29Affected
0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2 to before 385e474086c2e7e29e2dded690be40dc273e20eeAffected

LinuxLinux

5.6Affected
before 5.6Not affected
5.10.273 through 5.10.*Not affected
5.15.224 through 5.15.*Not affected
6.1.191 through 6.1.*Not affected
6.6.161 through 6.6.*Not affected
6.12.115 through 6.12.*Not affected
6.18.59 through 6.18.*Not affected
7.2.13 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.