{"apiVersion":"1.0","identifier":"CVE-2026-74696","description":"In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reuseport migration A listener-s TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SO_REUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one. fastopenq.qlen is charged in tcp_fastopen_create_child() when the child is created and uncharged in reqsk_fastopen_remove() when the handshake completes. The uncharge follows rsk_listener of the request the child points at, and inet_reqsk_clone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener-s qlen drifts negative and its limit no longer binds. Charge the new listener during migration, like reqsk_queue_migrated() already does for queue->young and queue->qlen.","publishedAt":"2026-08-22T16:16:44","lastModifiedAt":"2026-08-25T06:18:53","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-74696","cvssScore":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","epssProbability":0.0049,"riskScore":0.78,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-74696","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-74696","en":"https://www.redsauce.net/en/cves/CVE-2026-74696","fr":"https://www.redsauce.net/fr/cves/CVE-2026-74696","pt":"https://www.redsauce.net/pt/cves/CVE-2026-74696","de":"https://www.redsauce.net/de/cves/CVE-2026-74696","sk":"https://www.redsauce.net/sk/cves/CVE-2026-74696","el":"https://www.redsauce.net/el/cves/CVE-2026-74696"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-74696"}}