Log in Start free

Vulnerability · Published Nov 3, 2026 · Assigned by Linux

CVE-2026-99270tcp: Fix potential UAF in reqsk_timer_handler().

High 8.1

In plain English

A high-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 24% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)8.1High
Exploit odds (30 days)0.3%top 76.0% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free(). Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk's timer context, we can safely call timer_delete_sync() for the new reqsk. Let's pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk's timer.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linuxno fix listedDEBIAN-CVE-2026-99270
Debian:13linuxno fix listedDEBIAN-CVE-2026-99270
Debian:14linux7.1.3-1DEBIAN-CVE-2026-99270
Ubuntu:22.04:LTSlinuxno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinuxno fix listedUBUNTU-CVE-2026-99270
Ubuntu:26.04:LTSlinuxno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-awsno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-awsno fix listedUBUNTU-CVE-2026-99270
Ubuntu:26.04:LTSlinux-awsno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-aws-6.14no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-aws-6.17no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-aws-6.8no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-aws-7.0no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-99270
Ubuntu:26.04:LTSlinux-azureno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-azure-6.11no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-azure-6.14no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-azure-6.17no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-azure-6.8no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-azure-7.0no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-99270
Ubuntu:26.04:LTSlinux-azure-fdeno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-azure-fde-6.14no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-azure-fde-6.17no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-azure-fde-6.8no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-azure-fde-7.0no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-azure-nvidiano fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-azure-nvidia-6.14no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2026-99270
Ubuntu:26.04:LTSlinux-gcpno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-gcp-6.11no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-gcp-6.14no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-gcp-6.17no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-gcp-6.8no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-gcp-7.0no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-99270
Ubuntu:26.04:LTSlinux-gkeno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-gkeopno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-hwe-6.11no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-hwe-6.14no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-hwe-6.17no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-hwe-6.8no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-hwe-7.0no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2026-99270
Ubuntu:26.04:LTSlinux-ibmno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-ibm-6.8no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-intel-iotgno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-kvmno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-lowlatencyno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-lowlatency-hwe-6.11no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.8no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-99270
Ubuntu:26.04:LTSlinux-nvidiano fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-nvidia-6.11no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-nvidia-6.17no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-nvidia-6.8no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-nvidia-7.0no fix listedUBUNTU-CVE-2026-99270
Ubuntu:26.04:LTSlinux-nvidia-bosno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-nvidia-lowlatencyno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-nvidia-tegrano fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-nvidia-tegrano fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-nvidia-tegra-igxno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-oem-6.11no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-oem-6.14no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-oem-6.17no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-oem-6.8no fix listedUBUNTU-CVE-2026-99270
Ubuntu:26.04:LTSlinux-oem-7.0no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2026-99270
Ubuntu:26.04:LTSlinux-oracleno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-oracle-6.14no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-oracle-6.17no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-oracle-6.8no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-oracle-7.0no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-99270
Ubuntu:26.04:LTSlinux-raspino fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-99270
Ubuntu:26.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-99270
Ubuntu:26.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-riscv-6.14no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-riscv-6.17no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-riscv-6.8no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-riscv-7.0no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-vmwareno fix listedUBUNTU-CVE-2026-99270
Ubuntu:24.04:LTSlinux-xilinxno fix listedUBUNTU-CVE-2026-99270
Ubuntu:22.04:LTSlinux-xilinx-zynqmpno fix listedUBUNTU-CVE-2026-99270

Affected products (as reported)

VendorProductVersions
Linux Linux 83fccfc3940c4a2db90fd7e7079f5b465cd8c6af – before 97c8a3c1f73d828de43a5a88e8a9a143efb2b661d3a1196bfc462943694623412d8e03aaf172bdc14.1.11 – before 4.2
Linux Linux 4.2

References