DEBIAN-CVE-2026-99139: Use After Free

Published Oct 28, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockopt(TCPCONGESTION) dotcpgetsockopt() reads icsk->icskcaops->name without holding rcureadlock(). Since commit 0baf26b0fcd7 ("bpf: tcp: Support tcpcongestionops in bpf"), icskcaops can point to dynamically allocated BPF structops memory that may be freed concurrently via setsockopt(TCPCONGESTION), leading to a use-after-free. BUG: KASAN: slab-use-after-free in copytouser+0x37/0x60 Read of size 16 at addr ffff888013505260 by task exploit/149 copytouser+0x37/0x60 dotcpgetsockopt+0x158a/0x2460 (net/ipv4/tcp.c:4585) tcpgetsockopt+0x91/0xf0 sysgetsockopt+0xf7/0x170 Fix this by holding rcureadlock() around the caops->name access, using READONCE() to load icskcaops, and copying the name to a stack buffer before releasing the lock. Also annotate the relevant icskcaops stores with WRITEONCE() to fix the accompanying KCSAN data-race issue.

Affected Software

3 affected components

debian/linux*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Compensating control
In Linux kernel do_tcp_getsockopt() for TCP_CONGESTION, hold rcu_read_lock() around the ca_ops->name access, use READ_ONCE() to load icsk_ca_ops, copy the congestion-control name into a stack buffer before releasing the RCU read lock, and use the copied buffer afterward.
Compensating control
Annotate the relevant icsk_ca_ops stores with WRITE_ONCE() to address the accompanying KCSAN data race.

Event History

Oct 28, 2026

CVE Published

via OSV·11:17 AM

Data Sourced

via OSV·11:17 AM

DescriptionAffected Software

Frequently Asked Questions

What conditions are needed to trigger the use-after-free?

The race requires concurrent access to TCP congestion-control state: one path reads TCP_CONGESTION through getsockopt while another changes congestion control through setsockopt(TCP_CONGESTION). The unsafe case occurs when the congestion-control operations pointer refers to dynamically allocated BPF struct_ops memory that can be freed during the read.

Are systems without BPF TCP congestion-control struct_ops exposure affected in the same way?

The described use-after-free specifically depends on icsk_ca_ops pointing to dynamically allocated BPF struct_ops memory. The relevant support was introduced by the cited kernel commit enabling tcp_congestion_ops in BPF.

How can an affected system be identified?

A triggered issue may produce a KASAN slab-use-after-free report in _copy_to_user, with do_tcp_getsockopt and tcp_getsockopt in the stack trace. KCSAN may also report a data race involving icsk_ca_ops access or updates.

What does the fix change?

The fix protects access to the congestion-control name with rcu_read_lock, reads icsk_ca_ops using READ_ONCE, and copies the name into a stack buffer before releasing the lock. It also uses WRITE_ONCE for relevant icsk_ca_ops stores to address the associated KCSAN race.

DEBIAN-CVE-2026-99139: Use After Free

Affected Software

Remediation

Event History

Frequently Asked Questions

What conditions are needed to trigger the use-after-free?

Are systems without BPF TCP congestion-control struct_ops exposure affected in the same way?

How can an affected system be identified?

What does the fix change?

Company

Resources

Contact

Frequently Asked Questions

What conditions are needed to trigger the use-after-free?

Are systems without BPF TCP congestion-control struct_ops exposure affected in the same way?

How can an affected system be identified?

What does the fix change?