CVE-2026-74696

A flaw was found in the Linux kernel's TCP Fast Open (TFO) implementation. During SO_REUSEPORT listener migration, the system incorrectly accounts for pending TCP Fast Open requests. This can lead to a Denial of Service (DoS) by allowing an excessive number of Fast Open requests, potentially exhausting system resources.

TCP Fast Open max_qlen accounting can become incorrect when pending TFO children are migrated between SO_REUSEPORT listeners. The child request is charged to the old listener when it is created but can be uncharged from the new listener after inet_reqsk_clone repoints rsk_listener, allowing the new listener queue length to drift negative and stop enforcing the configured pending Fast Open limit. A remote client may then be able to send more pending TFO requests than intended if TCP_FASTOPEN and SO_REUSEPORT listener migration are used and a listener is closed while TFO children are still pending. For the CVSS the PR:N is selected because no privileges are required beyond network reachability to the affected TCP service once the vulnerable listener state exists. The issue is network reachable but requires a specific server configuration and migration timing, so AC:H is used. Impact is denial of service through resource consumption or service degradation rather than memory corruption or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.