CVE-2026-99138

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-99138", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.395Z", "datePublished": "2026-10-28T10:34:49.993Z", "dateUpdated": "2026-10-30T12:42:10.759Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-30T12:42:10.759Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)\n\ndo_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the\nget_info function pointer without rcu_read_lock(). With BPF struct_ops\ncongestion control, ca_ops can point to dynamically allocated memory\nthat is freed concurrently, resulting in a use-after-free when the\nkernel dereferences or calls through the stale pointer.\n\n BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0\n Read of size 8 at addr ffff888013701258 by task exploit/149\n do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564)\n tcp_getsockopt+0x91/0xf0\n __sys_getsockopt+0xf7/0x170\n\nFix this by wrapping the ca_ops load and get_info call within\nrcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load\nthe icsk_ca_ops pointer."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp.c", "net/ipv4/tcp_dctcp.c"], "versions": [{"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "lessThan": "7c312f17917455eedcea29735fa302ebb93cb9b9", "status": "affected", "versionType": "git"}, {"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "lessThan": "66b831b427301a9c3e485564009d476631413103", "status": "affected", "versionType": "git"}, {"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "lessThan": "a8b024cbf62b497062c86995737fc303e4cc384e", "status": "affected", "versionType": "git"}, {"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "lessThan": "8d5fc9e6dc09174d0da6e59678eb8e01a890cbd3", "status": "affected", "versionType": "git"}, {"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "lessThan": "e057d201640eebb8ed47ec924872c41570a3bd28", "status": "affected", "versionType": "git"}, {"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "lessThan": "86814e5370068ec2bf0caa6e6d55c3e5bfc6c324", "status": "affected", "versionType": "git"}, {"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "lessThan": "39aa489e85752f9de214edb0f85e4d578e57af29", "status": "affected", "versionType": "git"}, {"version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "lessThan": "385e474086c2e7e29e2dded690be40dc273e20ee", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp.c", "net/ipv4/tcp_dctcp.c"], "versions": [{"version": "5.6", "status": "affected"}, {"version": "0", "lessThan": "5.6", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.273", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.224", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.191", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.161", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.115", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.59", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.13", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.10.273"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "5.15.224"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.1.191"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.6.161"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.12.115"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "6.18.59"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.2.13"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.6", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/7c312f17917455eedcea29735fa302ebb93cb9b9"}, {"url": "https://git.kernel.org/stable/c/66b831b427301a9c3e485564009d476631413103"}, {"url": "https://git.kernel.org/stable/c/a8b024cbf62b497062c86995737fc303e4cc384e"}, {"url": "https://git.kernel.org/stable/c/8d5fc9e6dc09174d0da6e59678eb8e01a890cbd3"}, {"url": "https://git.kernel.org/stable/c/e057d201640eebb8ed47ec924872c41570a3bd28"}, {"url": "https://git.kernel.org/stable/c/86814e5370068ec2bf0caa6e6d55c3e5bfc6c324"}, {"url": "https://git.kernel.org/stable/c/39aa489e85752f9de214edb0f85e4d578e57af29"}, {"url": "https://git.kernel.org/stable/c/385e474086c2e7e29e2dded690be40dc273e20ee"}], "title": "tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/tcp.c", "net/ipv4/tcp_dctcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "7c312f17917455eedcea29735fa302ebb93cb9b9", "status": "affected", "version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "versionType": "git"}, {"lessThan": "66b831b427301a9c3e485564009d476631413103", "status": "affected", "version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "versionType": "git"}, {"lessThan": "a8b024cbf62b497062c86995737fc303e4cc384e", "status": "affected", "version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "versionType": "git"}, {"lessThan": "8d5fc9e6dc09174d0da6e59678eb8e01a890cbd3", "status": "affected", "version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "versionType": "git"}, {"lessThan": "e057d201640eebb8ed47ec924872c41570a3bd28", "status": "affected", "version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "versionType": "git"}, {"lessThan": "86814e5370068ec2bf0caa6e6d55c3e5bfc6c324", "status": "affected", "version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "versionType": "git"}, {"lessThan": "39aa489e85752f9de214edb0f85e4d578e57af29", "status": "affected", "version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "versionType": "git"}, {"lessThan": "385e474086c2e7e29e2dded690be40dc273e20ee", "status": "affected", "version": "0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/tcp.c", "net/ipv4/tcp_dctcp.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.6"}, {"lessThan": "5.6", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.273", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.224", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.191", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.161", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.115", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.59", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.13", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)\n\ndo_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the\nget_info function pointer without rcu_read_lock(). With BPF struct_ops\ncongestion control, ca_ops can point to dynamically allocated memory\nthat is freed concurrently, resulting in a use-after-free when the\nkernel dereferences or calls through the stale pointer.\n\n BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0\n Read of size 8 at addr ffff888013701258 by task exploit/149\n do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564)\n tcp_getsockopt+0x91/0xf0\n __sys_getsockopt+0xf7/0x170\n\nFix this by wrapping the ca_ops load and get_info call within\nrcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load\nthe icsk_ca_ops pointer."}], "id": "CVE-2026-99138", "lastModified": "2026-10-30T13:21:48.017", "metrics": {}, "published": "2026-10-28T11:17:33.740", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/385e474086c2e7e29e2dded690be40dc273e20ee"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/39aa489e85752f9de214edb0f85e4d578e57af29"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/66b831b427301a9c3e485564009d476631413103"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7c312f17917455eedcea29735fa302ebb93cb9b9"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/86814e5370068ec2bf0caa6e6d55c3e5bfc6c324"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8d5fc9e6dc09174d0da6e59678eb8e01a890cbd3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/a8b024cbf62b497062c86995737fc303e4cc384e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e057d201640eebb8ed47ec924872c41570a3bd28"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: kernel: Privilege escalation via use-after-free in TCP socket options", "id": "2562689", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2562689"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)\ndo_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the\nget_info function pointer without rcu_read_lock(). With BPF struct_ops\ncongestion control, ca_ops can point to dynamically allocated memory\nthat is freed concurrently, resulting in a use-after-free when the\nkernel dereferences or calls through the stale pointer.\nBUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0\nRead of size 8 at addr ffff888013701258 by task exploit/149\ndo_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564)\ntcp_getsockopt+0x91/0xf0\n__sys_getsockopt+0xf7/0x170\nFix this by wrapping the ca_ops load and get_info call within\nrcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load\nthe icsk_ca_ops pointer.", "A flaw was found in the Linux kernel. A local user could exploit this use-after-free vulnerability to escalate privileges or cause a Denial of Service (DoS). The issue occurs when querying Transmission Control Protocol (TCP) socket options without proper locking, causing the kernel to access memory that has been freed concurrently during congestion control operations."], "name": "CVE-2026-99138", "public_date": "2026-10-28T10:34:49Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-99138\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-99138\nhttps://git.kernel.org/stable/c/385e474086c2e7e29e2dded690be40dc273e20ee\nhttps://git.kernel.org/stable/c/39aa489e85752f9de214edb0f85e4d578e57af29\nhttps://git.kernel.org/stable/c/86814e5370068ec2bf0caa6e6d55c3e5bfc6c324"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2,86814e5370068ec2bf0caa6e6d55c3e5bfc6c324)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2,39aa489e85752f9de214edb0f85e4d578e57af29)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2,385e474086c2e7e29e2dded690be40dc273e20ee)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2,86814e5370068ec2bf0caa6e6d55c3e5bfc6c324)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2,39aa489e85752f9de214edb0f85e4d578e57af29)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[0baf26b0fcd74bbfcef53c5d5e8bad2b99c8d0d2,385e474086c2e7e29e2dded690be40dc273e20ee)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.6"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.6)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.59,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.2.13,7.3.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3,*]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-28T12:15:14.881576+00:00", "updated": "2026-10-30T05:30:09.657083+00:00", "vendors": ["linux", "linux$PRODUCT$linux", "linux$PRODUCT$linux_kernel"]}