CVE-2026-99270: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99270 is a Use-After-Free (UAF) vulnerability in the Linux kernel's TCP request socket timer handler (reqsk_timer_handler()). When TCP socket migration fails at inet_ehash_insert(), the code jumps to a cleanup label and immediately frees the new request socket via __reqsk_free() without first stopping its timer, allowing the timer to fire on freed memory. The vulnerability affects Linux kernel versions 4.1.11 through 4.2 (exclusive), as well as specific git commit ranges. It carries a CVSS v3.1 base score of 8.1 (High) (GitHub Advisory, Feedly).

The root cause is a Use-After-Free condition (CWE-416) in the Linux kernel's TCP stack. When reqsk_timer_handler() handles a failed socket migration via inet_ehash_insert(), execution jumps to the no_ownership: label and calls __reqsk_free() to release the new request socket. However, the new socket's timer is not stopped before the free, meaning the timer can subsequently fire and access the already-freed memory. The fix involves passing false to __inet_csk_reqsk_queue_drop() to invoke timer_delete_sync() on the new reqsk before freeing it, which is safe because the operation occurs within the original reqsk's timer context (GitHub Advisory, Kernel Patch).

Successful exploitation of this UAF vulnerability can result in high impacts to confidentiality, integrity, and availability of the affected system. An unauthenticated remote attacker could trigger the condition by sending specially crafted TCP packets during socket migration operations, potentially achieving remote code execution or causing a kernel crash (denial of service). Because the vulnerability resides in the kernel's TCP stack, exploitation could affect the entire host, including all processes and data on the system (GitHub Advisory, Feedly).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation (Feedly). The EPSS score is 0.0, indicating a very low current probability of exploitation in the wild. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires high attack complexity (network-based, no authentication, no user interaction required), as the attacker must trigger a specific race condition during TCP socket migration.

Apply the upstream Linux kernel patch that fixes the UAF by ensuring the new request socket's timer is stopped before the socket is freed in reqsk_timer_handler(). The fix is available at commit 97c8a3c1f73d828de43a5a88e8a9a143efb2b661 in the stable kernel tree (Kernel Patch). Users should update to a patched kernel version provided by their Linux distribution. Systems running kernel versions between 4.1.11 and 4.2 are confirmed affected and should be prioritized for patching.