CVE-2026-99138

A flaw was found in the Linux kernel. A local user could exploit this use-after-free vulnerability to escalate privileges or cause a Denial of Service (DoS). The issue occurs when querying Transmission Control Protocol (TCP) socket options without proper locking, causing the kernel to access memory that has been freed concurrently during congestion control operations.

This vulnerability is rated as Moderate severity rather than Important because successful exploitation requires local authenticated access and winning a tight race condition during the concurrent release of custom BPF congestion control structures. Standard Red Hat Enterprise Linux environments default to built-in kernel congestion algorithms rather than dynamic struct_ops implementations, which significantly restricts attack exposure. Under these specialized conditions, an unauthenticated remote vector is not possible, and local impact is constrained to a system crash or potential privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.