CVE-2026-99139

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free in do tcp getsockopt(TCP CONGESTION)

do tcp getsockopt() reads icsk->icsk ca ops->name without holding rcu read lock(). Since commit 0baf26b0fcd7 ("bpf: tcp: Support tcp congestion ops in bpf"), icsk ca ops can point to dynamically allocated BPF struct ops memory that may be freed concurrently via setsockopt(TCP CONGESTION), leading to a use-after-free.

BUG: KASAN: slab-use-after-free in copy to user+0x37/0x60 Read of size 16 at addr ffff888013505260 by task exploit/149 copy to user+0x37/0x60 do tcp getsockopt+0x158a/0x2460 (net/ipv4/tcp.c:4585) tcp getsockopt+0x91/0xf0 sys getsockopt+0xf7/0x170

Fix this by holding rcu read lock() around the ca ops->name access, using READ ONCE() to load icsk ca ops, and copying the name to a stack buffer before releasing the lock. Also annotate the relevant icsk ca ops stores with WRITE ONCE() to fix the accompanying KCSAN data-race issue.