AZL-112643: CVE-2026-99270 affecting package kernel 6.6.159.1-1
In the Linux kernel, the following vulnerability has been resolved:
tcp: Fix potential UAF in reqsktimerhandler().
When TCP socket migration fails at inetehashinsert() in reqsktimerhandler(), we jump to the noownership: label and free the new reqsk immediately with reqskfree().
Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF.
As we are in the original reqsk's timer context, we can safely call timerdeletesync() for the new reqsk.
Let's pass false to inetcskreqskqueuedrop() to stop the new reqsk's timer.
Affected Software
Event History
Frequently Asked Questions
What condition is required for the use-after-free to occur?
The issue is triggered when TCP socket migration fails at inet_ehash_insert() while reqsk_timer_handler() is running. In that failure path, the new request socket can be freed without its timer being stopped.
What does the fix change in the failing migration path?
The fix stops the new request socket's timer before the request socket is freed. It does this by passing false to __inet_csk_reqsk_queue_drop(), allowing the timer to be safely deleted from the original request socket's timer context.