DEBIAN-CVE-2026-99138: Use After Free

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockopt(TCPCCINFO) dotcpgetsockopt() reads icsk->icskcaops and dereferences the getinfo function pointer without rcureadlock(). With BPF structops congestion control, caops can point to dynamically allocated memory that is freed concurrently, resulting in a use-after-free when the kernel dereferences or calls through the stale pointer. BUG: KASAN: slab-use-after-free in dotcpgetsockopt+0x2037/0x23e0 Read of size 8 at addr ffff888013701258 by task exploit/149 dotcpgetsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564) tcpgetsockopt+0x91/0xf0 sysgetsockopt+0xf7/0x170 Fix this by wrapping the caops load and getinfo call within rcureadlock()/rcureadunlock(), and using READONCE() to load the icskcaops pointer.

Affected Software

3 affected components

debian/linux*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
In do_tcp_getsockopt(), wrap the icsk_ca_ops load and get_info call with rcu_read_lock()/rcu_read_unlock(), and use READ_ONCE() when loading the icsk_ca_ops pointer.

Event History

Oct 28, 2026

CVE Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Frequently Asked Questions

Which systems are exposed to this issue?

The described use-after-free condition applies when TCP congestion control is implemented with BPF struct_ops, allowing the congestion-control operations structure to refer to dynamically allocated memory that may be freed concurrently.

What operation triggers the vulnerable code path?

The vulnerable path is reached when TCP_CC_INFO is requested through getsockopt. The issue occurs if the kernel loads a stale icsk_ca_ops pointer and dereferences or calls its get_info function after the associated memory has been freed.

What can be done if the fix cannot be deployed immediately?

The description identifies BPF struct_ops congestion control as the condition that enables dynamically allocated congestion-control operations to be freed concurrently. Avoiding that configuration removes the specifically described exposure condition.

How does the fix prevent the use-after-free?

The fix protects the congestion-control operations pointer load and get_info call with rcu_read_lock() and rcu_read_unlock(), and loads the icsk_ca_ops pointer using READ_ONCE(). This prevents concurrent freeing from invalidating the pointer while it is being used.

DEBIAN-CVE-2026-99138: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

Which systems are exposed to this issue?

What operation triggers the vulnerable code path?

What can be done if the fix cannot be deployed immediately?

How does the fix prevent the use-after-free?

Company

Resources

Contact

Frequently Asked Questions

Which systems are exposed to this issue?

What operation triggers the vulnerable code path?

What can be done if the fix cannot be deployed immediately?

How does the fix prevent the use-after-free?