CVE-2026-99138 in Linux
Summary
by MITRE • 10/28/2026
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)
do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the get_info function pointer without rcu_read_lock(). With BPF struct_ops congestion control, ca_ops can point to dynamically allocated memory that is freed concurrently, resulting in a use-after-free when the kernel dereferences or calls through the stale pointer.
BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0 Read of size 8 at addr ffff888013701258 by task exploit/149 do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564) tcp_getsockopt+0x91/0xf0 __sys_getsockopt+0xf7/0x170
Fix this by wrapping the ca_ops load and get_info call within rcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load the icsk_ca_ops pointer.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The Linux kernel contains a critical concurrency vulnerability in the TCP subsystem, specifically within the do_tcp_getsockopt function when handling the TCP_CC_INFO socket option. This flaw represents a classic use-after-free condition that arises from improper synchronization of memory access during dynamic congestion control module operations. The root cause lies in the failure to acquire read-side locks before dereferencing the icsk_ca_ops pointer, which points to the congestion control algorithm's operation structure. In modern Linux networking stacks, particularly when BPF struct_ops are utilized for custom congestion controls, these structures can be dynamically allocated and freed by other kernel threads or processes while a user-space application is attempting to retrieve connection information via getsockopt calls.
The technical mechanism of this vulnerability involves the direct dereferencing of function pointers within the icsk_ca_ops structure without holding an RCU read lock. When BPF-based congestion control modules are loaded, they register their operation structures in memory that may be subject to rapid lifecycle changes. If a user-space process invokes getsockopt with TCP_CC_INFO at the precise moment when another kernel context is unloading or replacing the current congestion control module, the icsk_ca_ops pointer can become stale. The subsequent call to the get_info function pointer within this structure accesses memory that has already been freed back to the slab allocator. This leads to a use-after-free scenario where the kernel reads from or executes code in deallocated memory regions, potentially leading to data corruption, unpredictable behavior, or system crashes as indicated by KASAN reports showing invalid slab access.
The operational impact of this vulnerability is significant due to its potential for remote exploitation and local privilege escalation depending on the context. An attacker with network access can trigger this condition by repeatedly querying TCP connection information while concurrently manipulating BPF programs or congestion control modules, effectively creating a race condition that forces the kernel into an undefined state. The immediate consequence is often a kernel panic or oops due to invalid memory access, resulting in denial of service for all services running on the affected system. In more sophisticated attack scenarios, the ability to read from freed slab objects can allow attackers to leak sensitive kernel memory contents, such as pointers to other data structures or cryptographic keys, facilitating further exploitation steps like arbitrary code execution through heap spraying techniques that target the same slab cache where the congestion control structure resides.
This vulnerability is categorized under CWE-416, Use After Free, which describes errors resulting from using a pointer after it has been freed. From an offensive security perspective aligned with MITRE ATT&CK frameworks, this flaw relates to Tactic TA0005 Defense Evasion and specifically techniques involving memory corruption or exploitation of race conditions such as TOCTOU (Time-of-Check-Time-of-Use) vulnerabilities in kernel space. The lack of proper synchronization primitives allows an unprivileged user to influence the state of critical networking subsystems, violating the principle of least privilege by allowing local users to destabilize the entire operating system through standard socket API calls that should be safe under normal concurrency models.
The resolution implemented involves wrapping the loading of the icsk_ca_ops pointer and the subsequent invocation of its get_info function within an RCU read-side critical section using rcu_read_lock() and rcu_read_unlock(). This ensures that any memory referenced by these pointers remains valid for the duration of the operation, preventing access to freed memory even if other threads attempt to free or replace the congestion control structure concurrently. Additionally, the fix incorporates READ_ONCE() macro usage when loading the pointer value. This prevents compiler optimizations from reordering memory accesses and ensures that the most current version of the pointer is read atomically, further mitigating race conditions related to cache coherence and instruction scheduling on multi-core processors.
To mitigate this vulnerability in environments where immediate patching is not feasible, administrators should restrict access to network socket operations for untrusted users by configuring appropriate Linux capabilities or namespaces. Disabling dynamic loading of BPF programs that interact with TCP congestion control modules can also reduce the attack surface until a kernel update is applied. System monitoring tools should be configured to detect unusual patterns of getsockopt calls combined with frequent BPF program load and unload events, which may indicate an active exploitation attempt targeting this race condition. Regular updates to the Linux kernel are essential as this fix addresses fundamental synchronization issues in the networking stack that affect all systems utilizing modern congestion control mechanisms including those driven by eBPF programs.