NULL pointer dereference in Linux kernel - CVE-2026-99288

Vulnerability details

The vulnerability allows a remote attacker to cause a denial of service by triggering a kernel NULL pointer dereference and panic.

The vulnerability exists due to a race condition leading to a null pointer dereference in the Linux kernel TCP established-socket lookup functions __inet_lookup_established() and __inet6_lookup_established() when processing TCP traffic concurrently with socket memory reuse. A remote attacker can send TCP traffic that triggers reuse of a socket address with the same connection tuple, causing a lookup to return an unhashed request socket and subsequently dereference its null listener pointer to cause a denial of service.

Affected software

How to mitigate CVE-2026-99288

External References

• https://git.kernel.org/stable/c/8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd
• https://git.kernel.org/stable/c/d69100340b4cae08d40f898f1b601032403f6be6
• https://git.kernel.org/stable/c/eb8a2d156f2c1d862fffdfd1b3432bfbcd939879

Related Security Bulletins

• NULL pointer dereference in Linux kernel ipv6
• Debian update for linux