CVE-2026-99138

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCCINFO dotcpgetsockopt reads icsk-icskcaops and dereferences the getinfo function pointer without rcureadlock. With BPF structops congestion control, caops can point to dynamically...

CVE-2026-99139

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCONGESTION dotcpgetsockopt reads icsk-icskcaops-name without holding rcureadlock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcpcongestionops in bpf", icskcaops can point to...

CVE-2026-99138

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCCINFO dotcpgetsockopt reads icsk-icskcaops and dereferences the getinfo function pointer without rcureadlock. With BPF structops congestion control, caops can point to dynamically...

CVE-2026-99139

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCONGESTION dotcpgetsockopt reads icsk-icskcaops-name without holding rcureadlock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcpcongestionops in bpf", icskcaops can point to...

CVE-2026-99139 tcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCONGESTION dotcpgetsockopt reads icsk-icskcaops-name without holding rcureadlock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcpcongestionops in bpf", icskcaops can point to...

EUVD-2026-111891

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCONGESTION dotcpgetsockopt reads icsk-icskcaops-name without holding rcureadlock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcpcongestionops in bpf", icskcaops can point to...

CVE-2026-99139

The Linux kernel contains a use-after-free vulnerability in the do_tcp_getsockopt() function when handling the TCP_CONGESTION option. The root cause is that icsk_ca_ops->name is accessed without holding rcu_read_lock(). Since a specific commit enabled BPF support for tcp_congestion_ops, icsk_c...

EUVD-2026-111890

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCCINFO dotcpgetsockopt reads icsk-icskcaops and dereferences the getinfo function pointer without rcureadlock. With BPF structops congestion control, caops can point to dynamically...

CVE-2026-99138 tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCCINFO dotcpgetsockopt reads icsk-icskcaops and dereferences the getinfo function pointer without rcureadlock. With BPF structops congestion control, caops can point to dynamically...

CVE-2026-99138

The Linux kernel contains a use-after-free vulnerability in the do_tcp_getsockopt() function when handling TCP_CC_INFO. The issue occurs because the kernel dereferences the get_info function pointer from icsk->icsk_ca_ops without utilizing rcu_read_lock() . When using BPF struct_ops for conges...

UBUNTU-CVE-2026-99138

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCCINFO dotcpgetsockopt reads icsk-icskcaops and dereferences the getinfo function pointer without rcureadlock. With BPF structops congestion control, caops can point to dynamically...

UBUNTU-CVE-2026-99139

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free in dotcpgetsockoptTCPCONGESTION dotcpgetsockopt reads icsk-icskcaops-name without holding rcureadlock. Since commit 0baf26b0fcd7 "bpf: tcp: Support tcpcongestionops in bpf", icskcaops can point to...