CVE-2026-99288

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A race condition exists in the TCP socket lookup process for both IPv4 and IPv6. The issue occurs during established ehash lookups, which are lockless and utilize SLAB TYPESAFE BY RCU for socket caches. This allows memory to be reused before an RCU reader has finished. Specifically, the functions inet lookup established() and inet6 lookup established() may acquire a reference to a reused socket object that is unhashed, leading to a NULL pointer dereference when tcp v4 rcv() attempts to read sk state through a NULL listener. This can result in a kernel panic and a system crash.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.