DEBIAN-CVE-2026-99270: High severity debian/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsktimerhandler(). When TCP socket migration fails at inetehashinsert() in reqsktimerhandler(), we jump to the noownership: label and free the new reqsk immediately with reqskfree(). Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk's timer context, we can safely call timerdeletesync() for the new reqsk. Let's pass false to inetcskreqskqueuedrop() to stop the new reqsk's timer.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 7.1.3-1
Event History
Frequently Asked Questions
What conditions are required to trigger the use-after-free?
The issue requires TCP socket migration to fail during inet_ehash_insert() while reqsk_timer_handler() is running. The failed migration path can free a new request socket without first stopping its timer, allowing that timer to later access freed memory.
Is authentication or user interaction required for exploitation?
No. The supplied vector identifies the issue as remotely reachable with no privileges or user interaction required, although exploitation has high attack complexity.
What is the impact if exploited?
The provided severity vector rates confidentiality, integrity, and availability impact as high. The underlying flaw is a use-after-free involving a TCP request socket timer.