CVE-2026-99270: Use-After-Free in TCP Socket Migration

Critical Use-After-Free in Linux kernel TCP from failed migration. CVSS 8.1.

CVE-2026-99270 is a Use-After-Free in the Linux kernel's reqsk_timer_handler() function. When TCP socket migration fails at inet_ehash_insert(), the kernel frees the request without stopping the associated timer, causing access to already-freed memory. On high-concurrency systems with frequent socket migrations (containers, load balancers), this flaw can trigger critical incidents.

CVSS 8.1 (High): significant impact on TCP service availability and integrity. Current status reports the vulnerability as resolved with the fix integrated into subsequent kernel releases. Social signals (2 posts in 24 hours) confirm community attention: the CVSS score and critical nature of the flaw are highlighted for production systems.

Inventory production Linux servers and verify kernel version against available patches from distributors (Red Hat, Canonical, SUSE). High priority for TCP-intensive services, load balancers, container orchestration, and live migration infrastructures. Monitor kernel panic logs and crashes as possible indicators of exploitation in pre-patching environments.

At a glance

What: Use-After-Free in the reqsk_timer_handler() function of the Linux kernel: when TCP socket migration fails at inet_ehash_insert(), the kernel frees the new request with __reqsk_free() without stopping the associated timer, causing access to released memory (UAF).
Severity: CVSS 8.1 (High). Impact on availability and integrity of critical TCP services: kernel crashes, internal state corruption, connection interruptions in production.
Affected versions: Not specified in the official NVD description. Affects the Linux kernel in TCP components: reqsk_timer_handler() and inet_ehash_insert().
Fix: Update the Linux kernel to a version containing the fix. The correction implements timer_delete_sync() and passes false to __inet_csk_reqsk_queue_drop() to stop the timer before memory release.
Status: Published NVD 2026-11-03. Vulnerability resolved: the fix has been developed and integrated into subsequent kernel releases.
Action: Inventory production Linux servers. Verify installed kernel version and plan priority update for systems with high TCP loads, load balancers, container orchestration, and live migration infrastructures.

Sources: NVD, CVE-2026-99270

← All articles