AZL-111263: CVE-2026-99139 affecting package kernel 6.6.157.1-1
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free in dotcpgetsockopt(TCPCONGESTION)
dotcpgetsockopt() reads icsk->icskcaops->name without holding rcureadlock(). Since commit 0baf26b0fcd7 ("bpf: tcp: Support tcpcongestionops in bpf"), icskcaops can point to dynamically allocated BPF structops memory that may be freed concurrently via setsockopt(TCPCONGESTION), leading to a use-after-free.
BUG: KASAN: slab-use-after-free in copytouser+0x37/0x60 Read of size 16 at addr ffff888013505260 by task exploit/149 copytouser+0x37/0x60 dotcpgetsockopt+0x158a/0x2460 (net/ipv4/tcp.c:4585) tcpgetsockopt+0x91/0xf0 sysgetsockopt+0xf7/0x170
Fix this by holding rcureadlock() around the caops->name access, using READONCE() to load icskcaops, and copying the name to a stack buffer before releasing the lock. Also annotate the relevant icskcaops stores with WRITEONCE() to fix the accompanying KCSAN data-race issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In the Linux kernel's do_tcp_getsockopt() path for TCP_CONGESTION, hold rcu_read_lock() around the icsk_ca_ops->name access; load icsk_ca_ops with READ_ONCE() and copy the name to a stack buffer before releasing the lock.