Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-99270— tcp: Fix potential UAF in reqsk_timer_handler().

Quick assessment

Affected

Linux Linux

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Linux 内核中，以下漏洞已得到修复： tcp：修复中潜在的释放后使用（UAF）问题。当在中 TCP 套接字迁移因失败时，代码会跳转到标签，并立即通过释放新的对象。因此，在跳转至该标签之前，必须先停止新的定时器。然而，自所引用的提交之后，该定时器可能未被正确停止，从而导致释放后使用（UAF）漏洞。由于当前处于原始的定时器上下文中，我们可以安全地对新调用。解决方案是向传递参数，以停止新的定时器。

CVSS 8.1 · High Updated Nov 04, 2026

Possible ATT&CK Techniques 1 AI

T1068 · Exploitation for Privilege Escalation

Affected Version Matrix 6

Vendor	Product	Version Range	Status
Linux	Linux	`83fccfc3940c4a2db90fd7e7079f5b465cd8c6af< 97c8a3c1f73d828de43a5a88e8a9a143efb2b661`	affected
		`d3a1196bfc462943694623412d8e03aaf172bdc1`	affected
		`4.1.11< 4.2`	affected
		`4.2`	affected
		`< 4.2`	unaffected
		`7.1≤ *`	unaffected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

tcp: Fix potential UAF in reqsk_timer_handler().

Source: CVE Program / CVE List V5

Vulnerability Description

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free(). Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in the original reqsk's timer context, we can safely call timer_delete_sync() for the new reqsk. Let's pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk's timer.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Source: CVE Program / CVE List V5

Vulnerability Type

N/A

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
Linux	Linux	83fccfc3940c4a2db90fd7e7079f5b465cd8c6af ~ 97c8a3c1f73d828de43a5a88e8a9a143efb2b661	-
Linux	Linux	4.2	-

II. Public POCs for CVE-2026-99270

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-99270

请登录查看更多情报信息。

Other References for CVE-2026-99270 (1)

https://git.kernel.org/stable/c/97c8a3c1f73d828de43a5a88e8a9a143efb2b661

https://www.cve.org/CVERecord?id=CVE-2026-99270

Same Patch Batch · Linux · 2026-11-03 · 28 CVEs total

CVE-2026-99246	8.1 HIGH	tipc: protect node reset trace dump with node lock
CVE-2026-99264	7.8 HIGH	io_uring/net: don't retry recv on uncommitted buffers
CVE-2026-99269	7.8 HIGH	sched_ext: Wait for SCX_OPSS_DISPATCHING before moving tasks off DSQs
CVE-2026-99257		gpio: shared: gracefully handle no-device lookup of shared GPIOs
CVE-2026-99243		io-wq: order the exit bit against worker creation task work
CVE-2026-99245		KEYS: Fix key_reject_and_link() race with keyring restriction
CVE-2026-99244		pid_namespace: prevent TIF_NOTIFY_SIGNAL from interrupting the reaper
CVE-2026-99248		i2c: xiic: restore non-managed runtime PM to fix clk WARN flood
CVE-2026-99247		tracing: Do not initialize tracefs work if tracing is disabled
CVE-2026-99249		pid_namespace: make zap_pid_ns_processes() freezable
CVE-2026-99250		printk: Postpone kthread startup
CVE-2026-99251		Drivers: hv: Avoid infinite retry loop in init_vp_index()
CVE-2026-99252		io_uring/mpscq: disable preemption while pushing
CVE-2026-99253		io_uring/cancel: rearm local work wake up before sleep
CVE-2026-99255		io_uring/io-wq: don't hide a link from cancellations
CVE-2026-99254		io_uring: don't flood a cancelling task with task_work
CVE-2026-99256		dm cache: fix issue with background work locking
CVE-2026-99259		soc/tegra: pmc: Fix uninitialised clock rate
CVE-2026-99258		x86/hyperv: Avoid using per-cpu output page in hv_apicid_to_vp_index()
CVE-2026-99260		ntfs: fix resident conversion in ntfs_new_attr_flags

Showing top 20 of 28 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Linux

Same vendor: Linux