https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 05 Nov 2026 22:47:51 +0000 https://db.gcve.eu/vuln/cve-2026-99270 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>tcp: Fix potential UAF in reqsk_timer_handler().</p> <p>When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free().</p> <p>Thus, we must stop the new reqsk&#39;s timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF.</p> <p>As we are in the original reqsk&#39;s timer context, we can safely call timer_delete_sync() for the new reqsk.</p> <p>Let&#39;s pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk&#39;s timer.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>tcp: Fix potential UAF in reqsk_timer_handler().</p> <p>When TCP socket migration fails at inet_ehash_insert() in reqsk_timer_handler(), we jump to the no_ownership: label and free the new reqsk immediately with __reqsk_free().</p> <p>Thus, we must stop the new reqsk&#39;s timer before jumping to the label, but the timer might be missed since the cited commit, resulting in UAF.</p> <p>As we are in the original reqsk&#39;s timer context, we can safely call timer_delete_sync() for the new reqsk.</p> <p>Let&#39;s pass false to __inet_csk_reqsk_queue_drop() to stop the new reqsk&#39;s timer.</p> https://db.gcve.eu/vuln/cve-2026-99270