CVE-2026-99288: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-99288 is a NULL pointer dereference vulnerability in the Linux kernel's TCP established socket lookup mechanism, classified as a Denial of Service via race condition in TCP socket lookup. The flaw affects Linux kernel versions from 4.4 onward, with fixes available in versions 4.4 (patched commit), 6.12.117, 6.18.63, and 7.3.4. It was published on November 10, 2026, and has a CVSS v3.1 base score of 7.5 (High) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is a NULL pointer dereference (CWE-476) arising from a race condition in the Linux kernel's lockless TCP established hash table (ehash) lookups. Because the socket caches use SLAB_TYPESAFE_BY_RCU, memory can be reused before an RCU reader holding the old address has completed. After a tuple match, __inet_lookup_established() and __inet6_lookup_established() acquire a reference and re-check the tuple, but do not verify whether the returned socket object is actually hashed. If a socket address is reused for a new socket with the same 4-tuple (e.g., via a SYN cookie request socket), the lookup can return an unhashed object with a NULL rsk_listener, causing tcp_v4_rcv() to dereference a NULL pointer when reading sk_state. The fix adds a check for whether the nulls node is unhashed after acquiring a reference in both IPv4 and IPv6 lookup paths, restarting the lookup if the socket is unhashed or the tuple no longer matches (Red Hat Bugzilla, Red Hat Advisory).

Successful exploitation causes a kernel NULL pointer dereference, resulting in a kernel panic and system crash — a complete denial of service for the affected host. The crash occurs in interrupt context (swapper/4, PID 0), meaning no user-space recovery is possible and a reboot is required. While the primary impact is availability, the race condition involves socket memory reuse that could theoretically expose stale kernel memory references, though no confidentiality or integrity impact has been confirmed in current analysis (Red Hat Bugzilla, Red Hat Advisory).

There is no public proof-of-concept exploit and no evidence of in-the-wild exploitation at this time (Red Hat Advisory). A private PoC was used internally to reproduce the crash by driving socket memory reuse via SYN cookie request sockets. The vulnerability requires network access and low privileges (CVSS PR:L), and exploitation complexity is rated High due to the precise timing required to win the race condition. The CVE is not currently listed in the CISA Known Exploited Vulnerabilities catalog, and no EPSS score data is available at this time.

1. Reconnaissance: Identify a target Linux system running a vulnerable kernel version (4.4 through pre-patch versions of 6.12.x, 6.18.x, or 7.3.x) with TCP SYN cookies enabled (net.ipv4.tcp_syncookies=1).
2. Trigger SYN cookie path: Send a high volume of TCP SYN packets to an open port on the target to exhaust the SYN backlog and force the kernel to issue SYN cookies, creating request sockets via tcp_get_cookie_sock().
3. Race socket memory reuse: Simultaneously establish and tear down TCP connections with the same 4-tuple (source IP, source port, destination IP, destination port) to drive rapid socket allocation and deallocation, causing SLAB_TYPESAFE_BY_RCU memory reuse.
4. Win the race condition: Time the reuse so that an RCU reader in __inet_lookup_established() loads the address of the old request socket, then the new unhashed request socket (with NULL rsk_listener) is published at that address before the reference check completes.
5. Trigger NULL dereference: The lookup returns the unhashed new socket; tcp_v4_rcv() reads sk_state through the NULL rsk_listener, triggering a kernel NULL pointer dereference and kernel panic (Red Hat Bugzilla).

• Logs: Kernel logs (dmesg, /var/log/kern.log) showing BUG: kernel NULL pointer dereference, address: 0000000000000012 with RIP: 0010:tcp_v4_rcv; kernel panic messages referencing Fatal exception in interrupt.
• Logs: Call trace entries including ip_protocol_deliver_rcu, ip_local_deliver_finish, napi_complete_done, and virtnet_poll preceding the crash.
• Network: Unusually high rates of TCP SYN packets targeting a single port from one or multiple source IPs, consistent with SYN flood activity intended to trigger SYN cookie issuance.
• System: Unexpected system reboots or kernel panics on hosts with active TCP services, particularly under high connection load (Red Hat Bugzilla).

Apply the Linux kernel patches that add socket hashing validation to __inet_lookup_established() and __inet6_lookup_established(): commits d69100340b4c (one stable branch), 8e5172cbd227 (second stable branch), and eb8a2d156f2c (third stable branch). Upgrade to patched kernel versions: 6.12.117 or later, 6.18.63 or later, or 7.3.4 or later, once available from your Linux distribution. As a temporary workaround, disabling TCP SYN cookies (sysctl -w net.ipv4.tcp_syncookies=0) may reduce the attack surface, though this trades off SYN flood protection. Monitor Red Hat and other distribution advisories for backported patches to older supported kernels (Red Hat Advisory, Red Hat Bugzilla).