AZL-111260: CVE-2026-99138 affecting package kernel 6.6.157.1-1

Q: What conditions are needed to trigger this issue?

The race requires BPF struct_ops congestion control, where the congestion-control operations structure can refer to dynamically allocated memory that may be freed concurrently. A TCP_CC_INFO getsockopt call must then read and invoke the stale congestion-control callback pointer.

Q: Which systems are most likely exposed?

Systems using the Azure Linux kernel package version 6.6.157.1-1 are identified as affected. The described condition specifically concerns deployments using BPF struct_ops congestion-control implementations.

Q: How can I identify possible impact before patching?

Look for kernel KASAN reports identifying a slab use-after-free in do_tcp_getsockopt, with the call path including tcp_getsockopt and __sys_getsockopt. Also determine whether BPF struct_ops congestion control is in use on the system.

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free in dotcpgetsockopt(TCPCCINFO)

dotcpgetsockopt() reads icsk->icskcaops and dereferences the getinfo function pointer without rcureadlock(). With BPF structops congestion control, caops can point to dynamically allocated memory that is freed concurrently, resulting in a use-after-free when the kernel dereferences or calls through the stale pointer.

BUG: KASAN: slab-use-after-free in dotcpgetsockopt+0x2037/0x23e0 Read of size 8 at addr ffff888013701258 by task exploit/149 dotcpgetsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564) tcpgetsockopt+0x91/0xf0 sysgetsockopt+0xf7/0x170

Fix this by wrapping the caops load and getinfo call within rcureadlock()/rcureadunlock(), and using READONCE() to load the icskcaops pointer.

Affected Software

1 affected component

azure-linux/kernel<=6.6.157.1-1

Event History

Oct 28, 2026

Advisory Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2026-99138

Frequently Asked Questions

What conditions are needed to trigger this issue?

The race requires BPF struct_ops congestion control, where the congestion-control operations structure can refer to dynamically allocated memory that may be freed concurrently. A TCP_CC_INFO getsockopt call must then read and invoke the stale congestion-control callback pointer.

Which systems are most likely exposed?

Systems using the Azure Linux kernel package version 6.6.157.1-1 are identified as affected. The described condition specifically concerns deployments using BPF struct_ops congestion-control implementations.

How can I identify possible impact before patching?

Look for kernel KASAN reports identifying a slab use-after-free in do_tcp_getsockopt, with the call path including tcp_getsockopt and __sys_getsockopt. Also determine whether BPF struct_ops congestion control is in use on the system.

AZL-111260: CVE-2026-99138 affecting package kernel 6.6.157.1-1

Affected Software

Event History

Child vulnerabilities

Frequently Asked Questions

What conditions are needed to trigger this issue?

Which systems are most likely exposed?

How can I identify possible impact before patching?

Company

Resources

Contact

Frequently Asked Questions

What conditions are needed to trigger this issue?

Which systems are most likely exposed?

How can I identify possible impact before patching?