GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-74696 (GCVE-0-2026-74696)

Vulnerability from cvelistv5 – Published: 2026-08-22 15:32 – Updated: 2026-08-25 05:41
VLAI
Title
tcp: fix TFO max_qlen accounting across reuseport migration
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reuseport migration A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SO_REUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one. fastopenq.qlen is charged in tcp_fastopen_create_child() when the child is created and uncharged in reqsk_fastopen_remove() when the handshake completes. The uncharge follows rsk_listener of the request the child points at, and inet_reqsk_clone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener's qlen drifts negative and its limit no longer binds. Charge the new listener during migration, like reqsk_queue_migrated() already does for queue->young and queue->qlen.
Severity
7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < e98f0d80b9cccb5f828425d2004f9686e7d1ae24 (git)
Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < b6247e0f96bd825ffb2005257f6177b5e642dee6 (git)
Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < 585fc5247d14939a561056aa2addd9b7c2b1f670 (git)
Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < 6e10ee56524a26b250229ad348637825646ddb88 (git)
Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < a66e869cf0c90c1e47ae75f72b6482acbfc808ff (git)
Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < d974618b2097453778389d385e3741629c40e0a3 (git)
Affected: 54b92e84193749c9968aff2dd46e3b0f42643e18 , < a0ab2ba83e35159d81cec830a92e885ecf8139be (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.14
Unaffected: 0 , < 5.14 (semver)
Unaffected: 5.15.216 , ≤ 5.15.* (semver)
Unaffected: 6.1.183 , ≤ 6.1.* (semver)
Unaffected: 6.6.152 , ≤ 6.6.* (semver)
Unaffected: 6.12.104 , ≤ 6.12.* (semver)
Unaffected: 6.18.45 , ≤ 6.18.* (semver)
Unaffected: 7.1.9 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_connection_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e98f0d80b9cccb5f828425d2004f9686e7d1ae24",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "b6247e0f96bd825ffb2005257f6177b5e642dee6",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "585fc5247d14939a561056aa2addd9b7c2b1f670",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "6e10ee56524a26b250229ad348637825646ddb88",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "a66e869cf0c90c1e47ae75f72b6482acbfc808ff",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "d974618b2097453778389d385e3741629c40e0a3",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            },
            {
              "lessThan": "a0ab2ba83e35159d81cec830a92e885ecf8139be",
              "status": "affected",
              "version": "54b92e84193749c9968aff2dd46e3b0f42643e18",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/inet_connection_sock.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.14"
            },
            {
              "lessThan": "5.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.216",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.183",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.152",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.104",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.45",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.216",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.183",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.152",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.104",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.45",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.9",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix TFO max_qlen accounting across reuseport migration\n\nA listener\u0027s TCP_FASTOPEN max_qlen stops being accurate and lets through\nfar more pending Fast Open requests than it was configured for.\n\nThis only shows up with SO_REUSEPORT listener migration, where closing a\nlistener hands its still-pending TFO children over to a surviving one.\n\nfastopenq.qlen is charged in tcp_fastopen_create_child() when the child\nis created and uncharged in reqsk_fastopen_remove() when the handshake\ncompletes.  The uncharge follows rsk_listener of the request the child\npoints at, and inet_reqsk_clone() has repointed the child at a new\nrequest owned by the new listener, so the ++ and the -- land on two\ndifferent sockets.  The new listener\u0027s qlen drifts negative and its\nlimit no longer binds.\n\nCharge the new listener during migration, like reqsk_queue_migrated()\nalready does for queue-\u003eyoung and queue-\u003eqlen."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is in the inbound TCP SYN/TFO server path (tcp_v4_rcv/tcp_conn_request/tcp_try_fastopen), reachable by sending TCP Fast Open SYN packets to any internet-facing listener with server-side TFO enabled.\nAC:L - An attacker fully controls the TFO SYN flood; once a SO_REUSEPORT worker closes while TFO children are pending (routine nginx/k8s reloads), migration deterministically skews qlen negative with no narrow race or special memory layout required.\nPR:N - Exploitation needs only unauthenticated network reachability to the listening TCP port; no target credentials, capabilities, or local access are required because TFO SYN processing occurs before any application authentication.\nUI:N - No victim user action is needed beyond normal server operation; the remote attacker sends crafted TFO SYN traffic and benefits automatically when reuseport listener migration occurs during ordinary worker shutdown or reload.\nS:U - Impact is confined to the target host kernel TCP stack resource limits and availability; it does not cross VM, container, or IOMMU security boundaries to affect a different authority.\nC:N - The flaw is a signed counter accounting mismatch on fastopenq.qlen; it does not corrupt memory, leak kernel pointers, or provide an out-of-bounds read or use-after-free disclosure primitive.\nI:N - No arbitrary memory write, control-flow hijack, or unauthorized persistent data modification occurs; bypassing max_qlen only relaxes a rate limit while TFO cookie validation and normal TCP semantics still govern accepted data.\nA:H - With max_qlen disabled, a remote attacker can create far more pending TFO child sockets and SYN-carrying skbs than configured, exhausting kernel memory and socket tables and causing severe denial of service or OOM-induced host instability."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-25T05:41:40.079Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e98f0d80b9cccb5f828425d2004f9686e7d1ae24"
        },
        {
          "url": "https://git.kernel.org/stable/c/b6247e0f96bd825ffb2005257f6177b5e642dee6"
        },
        {
          "url": "https://git.kernel.org/stable/c/585fc5247d14939a561056aa2addd9b7c2b1f670"
        },
        {
          "url": "https://git.kernel.org/stable/c/6e10ee56524a26b250229ad348637825646ddb88"
        },
        {
          "url": "https://git.kernel.org/stable/c/a66e869cf0c90c1e47ae75f72b6482acbfc808ff"
        },
        {
          "url": "https://git.kernel.org/stable/c/d974618b2097453778389d385e3741629c40e0a3"
        },
        {
          "url": "https://git.kernel.org/stable/c/a0ab2ba83e35159d81cec830a92e885ecf8139be"
        }
      ],
      "title": "tcp: fix TFO max_qlen accounting across reuseport migration",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-74696",
    "datePublished": "2026-08-22T15:32:58.414Z",
    "dateReserved": "2026-08-15T05:44:03.926Z",
    "dateUpdated": "2026-08-25T05:41:40.079Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-74696",
      "date": "2026-09-16",
      "epss": "0.0049",
      "percentile": "0.4094"
    },
    "microsoft_vex": {
      "current_release_date": "2026-09-11T01:47:01.000Z",
      "cve": "CVE-2026-74696",
      "id": "msrc_CVE-2026-74696",
      "initial_release_date": "2026-08-24T01:03:48.000Z",
      "product_status:fixed": "1",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "tcp: fix TFO max_qlen accounting across reuseport migration",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-74696.json",
      "version": "3"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-74696\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-08-22T16:16:44.153\",\"lastModified\":\"2026-08-25T06:18:53.137\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: fix TFO max_qlen accounting across reuseport migration\\n\\nA listener\u0027s TCP_FASTOPEN max_qlen stops being accurate and lets through\\nfar more pending Fast Open requests than it was configured for.\\n\\nThis only shows up with SO_REUSEPORT listener migration, where closing a\\nlistener hands its still-pending TFO children over to a surviving one.\\n\\nfastopenq.qlen is charged in tcp_fastopen_create_child() when the child\\nis created and uncharged in reqsk_fastopen_remove() when the handshake\\ncompletes.  The uncharge follows rsk_listener of the request the child\\npoints at, and inet_reqsk_clone() has repointed the child at a new\\nrequest owned by the new listener, so the ++ and the -- land on two\\ndifferent sockets.  The new listener\u0027s qlen drifts negative and its\\nlimit no longer binds.\\n\\nCharge the new listener during migration, like reqsk_queue_migrated()\\nalready does for queue-\u003eyoung and queue-\u003eqlen.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/ipv4/inet_connection_sock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"54b92e84193749c9968aff2dd46e3b0f42643e18\",\"lessThan\":\"e98f0d80b9cccb5f828425d2004f9686e7d1ae24\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54b92e84193749c9968aff2dd46e3b0f42643e18\",\"lessThan\":\"b6247e0f96bd825ffb2005257f6177b5e642dee6\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54b92e84193749c9968aff2dd46e3b0f42643e18\",\"lessThan\":\"585fc5247d14939a561056aa2addd9b7c2b1f670\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54b92e84193749c9968aff2dd46e3b0f42643e18\",\"lessThan\":\"6e10ee56524a26b250229ad348637825646ddb88\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54b92e84193749c9968aff2dd46e3b0f42643e18\",\"lessThan\":\"a66e869cf0c90c1e47ae75f72b6482acbfc808ff\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54b92e84193749c9968aff2dd46e3b0f42643e18\",\"lessThan\":\"d974618b2097453778389d385e3741629c40e0a3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"54b92e84193749c9968aff2dd46e3b0f42643e18\",\"lessThan\":\"a0ab2ba83e35159d81cec830a92e885ecf8139be\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/ipv4/inet_connection_sock.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.14\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.14\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.216\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.183\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.152\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.104\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.45\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.9\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/585fc5247d14939a561056aa2addd9b7c2b1f670\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6e10ee56524a26b250229ad348637825646ddb88\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a0ab2ba83e35159d81cec830a92e885ecf8139be\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a66e869cf0c90c1e47ae75f72b6482acbfc808ff\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b6247e0f96bd825ffb2005257f6177b5e642dee6\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d974618b2097453778389d385e3741629c40e0a3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e98f0d80b9cccb5f828425d2004f9686e7d1ae24\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-25T08:54:32+00:00",
      "cve": "CVE-2026-74696",
      "id": "CVE-2026-74696",
      "initial_release_date": "2026-08-22T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tcp: fix TFO max_qlen accounting across reuseport migration",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-74696.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:16:21Z",
      "cve": "CVE-2026-74696",
      "id": "CVE-2026-74696",
      "initial_release_date": "2026-08-27T00:21:51Z",
      "product_status:known_affected": "214",
      "product_status:known_not_affected": "143",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-74696",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-74696.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.