CVE-2026-99138

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free in do tcp getsockopt(TCP CC INFO)

do tcp getsockopt() reads icsk->icsk ca ops and dereferences the get info function pointer without rcu read lock(). With BPF struct ops congestion control, ca ops can point to dynamically allocated memory that is freed concurrently, resulting in a use-after-free when the kernel dereferences or calls through the stale pointer.

BUG: KASAN: slab-use-after-free in do tcp getsockopt+0x2037/0x23e0 Read of size 8 at addr ffff888013701258 by task exploit/149 do tcp getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564) tcp getsockopt+0x91/0xf0 sys getsockopt+0xf7/0x170

Fix this by wrapping the ca ops load and get info call within rcu read lock()/rcu read unlock(), and using READ ONCE() to load the icsk ca ops pointer.