UBUNTU-CVE-2026-99270: Medium severity ubuntu/linux vulnerability
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsktimerhandler(). When TCP socket migration fails at inetehashinsert() in reqsktimerhandler(), we jump to the noownership: label and free the new reqsk immediately with reqskfree(). Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk's timer context, we can safely call timerdeletesync() for the new reqsk. Let's pass false to inetcskreqskqueuedrop() to stop the new reqsk's timer.
Affected Software
Event History
Frequently Asked Questions
Which Ubuntu kernel packages are listed as affected?
The listed software includes ubuntu/linux, ubuntu/linux-fips, ubuntu/linux-aws, ubuntu/linux-azure, ubuntu/linux-gcp, ubuntu/linux-oracle, ubuntu/linux-aws-fips, and ubuntu/linux-azure-fips.
What condition is required for the use-after-free to occur?
TCP socket migration must fail at inet_ehash_insert() while reqsk_timer_handler() is running. In that failure path, a newly allocated request socket can be freed without its timer being stopped, allowing the timer to later access freed memory.
What does the fix change?
The fix ensures the new request socket's timer is stopped before the request socket is freed on the socket-migration failure path. It does this by passing false to __inet_csk_reqsk_queue_drop() so the timer is deleted synchronously.