CVE-2026-99270: tcp: Fix potential UAF in reqsk_timer_handler().
In the Linux kernel, the following vulnerability has been resolved:
tcp: Fix potential UAF in reqsktimerhandler().
When TCP socket migration fails at inetehashinsert() in reqsktimerhandler(), we jump to the noownership: label and free the new reqsk immediately with reqskfree().
Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF.
As we are in the original reqsk's timer context, we can safely call timerdeletesync() for the new reqsk.
Let's pass false to inetcskreqskqueuedrop() to stop the new reqsk's timer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.3-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.2.12-1Fixed in 7.2.15-1