{"id":"AZL-111263","summary":"CVE-2026-99139 affecting package kernel 6.6.157.1-1","details":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix use-after-free in do_tcp_getsockopt(TCP_CONGESTION)\n\ndo_tcp_getsockopt() reads icsk-\u003eicsk_ca_ops-\u003ename without holding\nrcu_read_lock(). Since commit 0baf26b0fcd7 (\"bpf: tcp: Support\ntcp_congestion_ops in bpf\"), icsk_ca_ops can point to dynamically\nallocated BPF struct_ops memory that may be freed concurrently via\nsetsockopt(TCP_CONGESTION), leading to a use-after-free.\n\n  BUG: KASAN: slab-use-after-free in _copy_to_user+0x37/0x60\n  Read of size 16 at addr ffff888013505260 by task exploit/149\n   _copy_to_user+0x37/0x60\n   do_tcp_getsockopt+0x158a/0x2460 (net/ipv4/tcp.c:4585)\n   tcp_getsockopt+0x91/0xf0\n   __sys_getsockopt+0xf7/0x170\n\nFix this by holding rcu_read_lock() around the ca_ops-\u003ename access,\nusing READ_ONCE() to load icsk_ca_ops, and copying the name to a\nstack buffer before releasing the lock. Also annotate the relevant\nicsk_ca_ops stores with WRITE_ONCE() to fix the accompanying KCSAN\ndata-race issue.","modified":"2026-10-29T14:16:53.983898123Z","published":"2026-10-28T11:17:33Z","upstream":["CVE-2026-99139"],"references":[{"type":"WEB","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-99139"}],"affected":[{"package":{"name":"kernel","ecosystem":"Azure Linux:3","purl":"pkg:rpm/azure-linux/kernel"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"6.6.157.1-1"}]}],"database_specific":{"source":"https://github.com/microsoft/AzureLinuxVulnerabilityData/blob/main/osv/AZL-111263.json"}}],"schema_version":"1.9.2"}