PatchTheCVECVE-2026-99270: In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_han
CVE-2026-99270 is a high-severity flaw (CVSS n/a) affecting affected software. Below: why it ranks where it does, which versions are affected, what to do, and the exact commands.
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free(). Thus, we must stop the new reqsk's timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF. As we are in th
Why this priority
- Covered by 3 security sources
- On your watchlist
No fix is published yet: follow the downgrade or mitigation steps.
Risk facts
| CVSS score | n/a (High) |
| EPSS exploit chance | n/a |
| CISA exploited list | No |
| Published | 2026-11-03 |
| Last modified | 2026-11-03 |
Last updated 2026-11-03 · Sources: CVE Program, NVD, CISA KEV, EPSS and vendor advisories · How we score
Timeline
- Published CVE record published
- Updated Record last modified
Advisories and coverage
Official advisories
- Linux Kernel CVE Announce: CVE-2026-99270: tcp: Fix potential UAF in reqsk_timer_handler(). 2026-11-03
Research and news
- Vulners Bulletins: CVE-2026-99270 2026-11-03
- VulDB Recent Entries: CVE-2026-99270 | Linux Kernel tcp reqsk_timer_handler use after free 2026-11-03
Scores and fixes here are computed automatically from those and other public sources. Confirm with the vendor advisory before changing production systems.
Quick answers
How do I fix CVE-2026-99270?
No fixed release is listed yet. Watch the vendor advisory and apply any mitigation shown on this page.
Is CVE-2026-99270 being exploited?
CVE-2026-99270 is not on the CISA Known Exploited Vulnerabilities list at the time of the last update. Check again, as this can change.
What does CVE-2026-99270 affect?
CVE-2026-99270 affects affected software. Severity is high (CVSS n/a). In the Linux kernel, the following vulnerability has been resolved: tcp: Fix potential UAF in reqsk_timer_handler(). When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and f
How urgent is CVE-2026-99270?
Priority 8/100. Covered by 3 security sources; On your watchlist