CVE-2026-99270

Popis

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free(). Thus, we must stop the new reqsk-s timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk-s timer context, we can safely call timer_delete_sync() for the new reqsk. Let-s pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk-s timer.