CVE-2026-74696

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the TCP Fast Open (TFO) implementation where the max qlen accounting for a listener becomes inaccurate during SO REUSEPORT listener migration. When a listener is closed, pending TFO children are transferred to a surviving listener. Because the charge is applied in tcp fastopen create child() and the uncharge occurs in reqsk fastopen remove() after inet reqsk clone() has repointed the child to a new request, the accounting operations occur on different sockets. This causes the new listener's fastopenq.qlen to drift negative, effectively bypassing the configured limit and allowing significantly more pending Fast Open requests than intended.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.