CVE-2026-99138
Description
A flaw was found in the Linux kernel. A local user could exploit this use-after-free vulnerability to escalate privileges or cause a Denial of Service (DoS). The issue occurs when querying Transmission Control Protocol (TCP) socket options without proper locking, causing the kernel to access memory that has been freed concurrently during congestion control operations.
Statement
This vulnerability is rated as Moderate severity rather than Important because successful exploitation requires local authenticated access and winning a tight race condition during the concurrent release of custom BPF congestion control structures. Standard Red Hat Enterprise Linux environments default to built-in kernel congestion algorithms rather than dynamic struct_ops implementations, which significantly restricts attack exposure. Under these specialized conditions, an unauthenticated remote vector is not possible, and local impact is constrained to a system crash or potential privilege escalation.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 7 | N/A | N/A |
| Attack Vector | Local | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | Low | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | High | N/A | N/A |
| Availability Impact | High | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
