CVE-2026-99138: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free in dotcpgetsockopt(TCPCCINFO)
dotcpgetsockopt() reads icsk->icskcaops and dereferences the getinfo function pointer without rcureadlock(). With BPF structops congestion control, caops can point to dynamically allocated memory that is freed concurrently, resulting in a use-after-free when the kernel dereferences or calls through the stale pointer.
BUG: KASAN: slab-use-after-free in dotcpgetsockopt+0x2037/0x23e0 Read of size 8 at addr ffff888013701258 by task exploit/149 dotcpgetsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564) tcpgetsockopt+0x91/0xf0 sysgetsockopt+0xf7/0x170
Fix this by wrapping the caops load and getinfo call within rcureadlock()/rcureadunlock(), and using READONCE() to load the icskcaops pointer.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In Linux kernel do_tcp_getsockopt(TCP_CC_INFO), wrap the ca_ops load and get_info call with rcu_read_lock()/rcu_read_unlock(), and use READ_ONCE() to load the icsk_ca_ops pointer.