Strix
73.2K

CVE-2026-99138

UnknownEPSS 0.17%

Last modified

CVE-2026-99138 is a vulnerability of currently unknown severity. In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the get_info function pointer without rcu_read_lock(). With BPF struct_ops congestion control, ca_ops can point to dynamically allocated memory that is freed concurrently, resulting in a use-after-free when the kernel dereferences or calls through the stale pointer. BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0 Read of size 8 at addr ffff888013701258 by task exploit/149 do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564) tcp_getsockopt+0x91/0xf0 __sys_getsockopt+0xf7/0x170 Fix this by wrapping the ca_ops load and get_info call within rcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load the icsk_ca_ops pointer.. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the get_info function pointer without rcu_read_lock(). With BPF struct_ops congestion control, ca_ops can point to dynamically allocated memory that is freed concurrently, resulting in a use-after-free when the kernel dereferences or calls through the stale pointer. BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0 Read of size 8 at addr ffff888013701258 by task exploit/149 do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564) tcp_getsockopt+0x91/0xf0 __sys_getsockopt+0xf7/0x170 Fix this by wrapping the ca_ops load and get_info call within rcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load the icsk_ca_ops pointer.

Metrics

EPSS Probability
0.17%

5.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2, < 7c312f17917455eedcea29735fa302ebb93cb9b9; >= 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2, < 66b831b427301a9c3e485564009d476631413103; >= 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2, < a8b024cbf62b497062c86995737fc303e4cc384e; >= 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2, < 8d5fc9e6dc09174d0da6e59678eb8e01a890cbd3; >= 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2, < e057d201640eebb8ed47ec924872c41570a3bd28; >= 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2, < 86814e5370068ec2bf0caa6e6d55c3e5bfc6c324; >= 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2, < 39aa489e85752f9de214edb0f85e4d578e57af29; >= 0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2, < 385e474086c2e7e29e2dded690be40dc273e20ee
LinuxLinux5.6

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-99138?
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO) do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the get_info function pointer without rcu_read_lock(). With BPF struct_ops congestion control, ca_ops can point to dynamically allocated memory that is freed concurrently, resulting in a use-after-free when the kernel dereferences or calls through the stale pointer. BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0 Read of size 8 at addr ffff888013701258 by task exploit/149 do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564) tcp_getsockopt+0x91/0xf0 __sys_getsockopt+0xf7/0x170 Fix this by wrapping the ca_ops load and get_info call within rcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load the icsk_ca_ops pointer.
How severe is CVE-2026-99138?
Severity scoring for CVE-2026-99138 is pending analysis. The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-99138?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-99138?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST