CVE-2026-99288: inet: reject unhashed sockets during established lookups
In the Linux kernel, the following vulnerability has been resolved:
inet: reject unhashed sockets during established lookups
TCP established ehash lookups are lockless. The socket caches involved use SLABTYPESAFEBYRCU, so memory can be reused before an RCU reader that retained its old address has finished.
After a tuple match, inetlookupestablished() and inet6lookupestablished() acquire a reference and repeat the tuple check. They do not check whether the new object is hashed. If the address is reused for a socket with the same tuple, the lookup can acquire a reference to the new object and return it while its nulls node is unhashed.
A PoC that drives reuse with a SYN cookie request socket reproduced the crash. The new request socket is unhashed and has a NULL rsklistener. A lookup that had loaded the address of the old request socket acquired the reference published by tcpgetcookiesock() and returned the new object. tcpv4rcv() then read skstate through the NULL listener.
The resulting crash was:
BUG: kernel NULL pointer dereference, address: 0000000000000012 #PF: supervisor read access in kernel mode #PF: errorcode(0x0000) - not-present page ... Oops: Oops: 0000 [#1] SMP NOPTI CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 7.3.0-00591-g0e135910deec #1 PREEMPT(lazy) ... RIP: 0010:tcpv4rcv+0x44e/0x1280 ... R10: 0000000000000001 R11: 00000000024ca8c0 R12: 0000000000000000 ... CR2: 0000000000000012 CR3: 0000000103d50004 CR4: 0000000000770ef0 ... Call Trace: <IRQ> ? rawlocaldeliver+0xae/0x240 ipprotocoldeliverrcu+0x2d/0x180 iplocaldeliverfinish+0x84/0x100 ipsublistrcvfinish+0x5f/0x70 ipsublistrcv+0x12a/0x1d0 iplistrcv+0xfd/0x130 netifreceiveskblistcore+0x223/0x250 netifreceiveskblistinternal+0x1d2/0x2c0 ? tryfillrecv+0x39/0x7b0 napicompletedone+0x74/0x170 virtnetpoll+0x445/0x600 napipoll+0x27/0x1e0 netrxaction+0x2fe/0x3b0 handlesoftirqs+0xc2/0x2c0 irqexitrcu+0x74/0xd0 commoninterrupt+0x7f/0x90 </IRQ> ... Kernel panic - not syncing: Fatal exception in interrupt
After taking a reference, check whether the nulls node is unhashed in both IPv4 and IPv6 established lookups. If it is unhashed or the tuple no longer matches, drop the reference and restart the lookup.
Lookups racing with the TIMEWAIT hashdance, or with a request being replaced by its child, now restart and find the new socket instead of returning the old one.
Request sockets that were never inserted into ehash can have a nonzero refcount, and a stale lookup can hold a transient reference. Therefore, when SYN cookie, Fast Open, and request migration paths fail after setting a nonzero refcount, release the references held by those paths with reqskput() instead of freeing the request directly.