{"apiVersion":"1.0","identifier":"CVE-2026-99270","description":"In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free(). Thus, we must stop the new reqsk-s timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk-s timer context, we can safely call timer_delete_sync() for the new reqsk. Let-s pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk-s timer.","publishedAt":"2026-11-03T13:17:24","lastModifiedAt":"2026-11-06T18:18:33","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-99270","cvssScore":8.1,"cvssVector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H","epssProbability":0.00402,"riskScore":0.84,"affectedProduct":"Linux kernel","affectedVersions":"unknown","vulnerabilityType":"Kernel","operatingSystems":[],"links":{"self":"https://www.redsauce.net/api/cves/CVE-2026-99270","webPages":{"es":"https://www.redsauce.net/es/cves/CVE-2026-99270","en":"https://www.redsauce.net/en/cves/CVE-2026-99270","fr":"https://www.redsauce.net/fr/cves/CVE-2026-99270","pt":"https://www.redsauce.net/pt/cves/CVE-2026-99270","de":"https://www.redsauce.net/de/cves/CVE-2026-99270","sk":"https://www.redsauce.net/sk/cves/CVE-2026-99270","el":"https://www.redsauce.net/el/cves/CVE-2026-99270"},"source":"https://nvd.nist.gov/vuln/detail/CVE-2026-99270"}}