CVE-2026-99139: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free in dotcpgetsockopt(TCPCONGESTION)
dotcpgetsockopt() reads icsk->icskcaops->name without holding rcureadlock(). Since commit 0baf26b0fcd7 ("bpf: tcp: Support tcpcongestionops in bpf"), icskcaops can point to dynamically allocated BPF structops memory that may be freed concurrently via setsockopt(TCPCONGESTION), leading to a use-after-free.
BUG: KASAN: slab-use-after-free in copytouser+0x37/0x60 Read of size 16 at addr ffff888013505260 by task exploit/149 copytouser+0x37/0x60 dotcpgetsockopt+0x158a/0x2460 (net/ipv4/tcp.c:4585) tcpgetsockopt+0x91/0xf0 sysgetsockopt+0xf7/0x170
Fix this by holding rcureadlock() around the caops->name access, using READONCE() to load icskcaops, and copying the name to a stack buffer before releasing the lock. Also annotate the relevant icskcaops stores with WRITEONCE() to fix the accompanying KCSAN data-race issue.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In do_tcp_getsockopt(TCP_CONGESTION), use READ_ONCE() to load icsk->icsk_ca_ops, hold rcu_read_lock() around the ca_ops->name access, copy the name into a stack buffer before releasing the RCU read lock, and then copy it to userspace.