Use-after-free in Linux kernel - CVE-2026-99139
Published: October 29, 2026
Vulnerability identifier: #VU158459
CSH Severity: Low
CVSS v4: 5.8 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-99139
CWE-ID: CWE-416
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to potentially cause a denial of service or disclose kernel memory.
The vulnerability exists due to use-after-free in the Linux kernel's do_tcp_getsockopt() function when reading the TCP_CONGESTION algorithm name without RCU read-side protection. A local user can race getsockopt(TCP_CONGESTION) with setsockopt(TCP_CONGESTION), causing dynamically allocated BPF struct_ops memory to be freed while its name is being copied to user space, to potentially crash the kernel or disclose kernel memory.
Affected software
Linux kernel
Debian Linux
linux (Debian package)
Debian Linux
linux (Debian package)
How to mitigate CVE-2026-99139
Install security update from vendor's repository.
Linux kernel - update to 7.0 rc3
linux (Debian package) - update to 6.12.115-2
linux (Debian package) - update to 6.12.115-2