CVE-2026-99288

inet: reject unhashed sockets during established lookups

Products / packages Linux

Published 10/11/2026, 18:19:08 UTC

Severity and exploitation

Not in CISA KEVNo CVSS score

KEV coverage does not rule out exploitation.

KEV checked 14/11/2026, 21:05:32 UTC

Severity

unknown

CVSS measures technical severity, not the likelihood of an attack.

Known exploitation

Not listed in the checked CISA KEV catalog

Absence from CISA KEV does not rule out attacks.

Public exploit

Not established by this record

Missing evidence does not mean no public exploit exists.

Remediation

Fix status not established

No structured fix or guidance is available here. Check the latest publisher advisory.

What this means

The Linux kernel is vulnerable due to a weakness in established lookups, where unhashed sockets can be returned, potentially causing a kernel crash. The vulnerability affects Linux kernel versions starting from 4.4. An attacker with access to the system may exploit this weakness.

Summarized by @cf/meta/llama-3.3-70b-instruct-fp8-fast. Verify details against the original sources.

Attack conditions

No attack-condition excerpt has been identified here. Review the full source description and references for authentication, network access, and configuration requirements.

Review supporting sources →

Affected versions

Check the exact model, release, and any platform requirements against your installation.

Linux · Linux

Linux

4 ranges

Linux version evidence

Check a product version

Compare with this publisher’s ranges. This does not inspect your installation.

affected

079096f103faca2dd87342cca6f23d4b34da8871 → before d69100340b4cae08d40f898f1b601032403f6be6

git versions

079096f103faca2dd87342cca6f23d4b34da8871 → before 8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd

git versions

079096f103faca2dd87342cca6f23d4b34da8871 → before eb8a2d156f2c1d862fffdfd1b3432bfbcd939879

git versions

079096f103faca2dd87342cca6f23d4b34da8871 → before 4e2b3ef19e0e04adca38442f07dd6bc93c712bf1

git versions

Other versions: unaffected

Linux · Linux

Linux

6 ranges

Linux version evidence

Check a product version

Compare with this publisher’s ranges. This does not inspect your installation.

affected

4.4

unaffected

0 → before 4.4

semver versions

6.12.117 → through 6.12.*

semver versions

6.18.63 → through 6.18.*

semver versions

7.3.4 → through 7.3.*

semver versions

7.4-rc2 → through *

original_commit_for_fix versions

Other versions: affected

Automatic dependency matching is unavailable for this record. Use the product evidence and publisher’s instructions to check your installation.

What to do

Compare your installed product and version with the affected versions above. A matching product name alone does not confirm exposure.

No structured fix or remediation guidance is available here. Check the full source description and vendor’s latest advisory for a patch or workaround; do not assume another version is safe.

cve.new guidance unless attributed to a publisher. This page does not inspect your installation.

Public exploit evidence

No public exploit reference is identified in the imported evidence. This is not a claim that no exploit exists.

Original source description

Read the full publisher description

In the Linux kernel, the following vulnerability has been resolved:

inet: reject unhashed sockets during established lookups

TCP established ehash lookups are lockless. The socket caches involved use SLAB_TYPESAFE_BY_RCU, so memory can be reused before an RCU reader that retained its old address has finished.

After a tuple match, __inet_lookup_established() and __inet6_lookup_established() acquire a reference and repeat the tuple check. They do not check whether the new object is hashed. If the address is reused for a socket with the same tuple, the lookup can acquire a reference to the new object and return it while its nulls node is unhashed.

A PoC that drives reuse with a SYN cookie request socket reproduced the crash. The new request socket is unhashed and has a NULL rsk_listener. A lookup that had loaded the address of the old request socket acquired the reference published by tcp_get_cookie_sock() and returned the new object. tcp_v4_rcv() then read sk_state through the NULL listener.

The resulting crash was:

BUG: kernel NULL pointer dereference, address: 0000000000000012 #PF: supervisor read access in kernel mode #PF: error_code(0x0000) - not-present page ... Oops: Oops: 0000 [#1] SMP NOPTI CPU: 4 UID: 0 PID: 0 Comm: swapper/4 Not tainted 7.3.0-00591-g0e135910deec #1 PREEMPT(lazy) ... RIP: 0010:tcp_v4_rcv+0x44e/0x1280 ... R10: 0000000000000001 R11: 00000000024ca8c0 R12: 0000000000000000 ... CR2: 0000000000000012 CR3: 0000000103d50004 CR4: 0000000000770ef0 ... Call Trace: <IRQ> ? raw_local_deliver+0xae/0x240 ip_protocol_deliver_rcu+0x2d/0x180 ip_local_deliver_finish+0x84/0x100 ip_sublist_rcv_finish+0x5f/0x70 ip_sublist_rcv+0x12a/0x1d0 ip_list_rcv+0xfd/0x130 __netif_receive_skb_list_core+0x223/0x250 netif_receive_skb_list_internal+0x1d2/0x2c0 ? try_fill_recv+0x39/0x7b0 napi_complete_done+0x74/0x170 virtnet_poll+0x445/0x600 __napi_poll+0x27/0x1e0 net_rx_action+0x2fe/0x3b0 handle_softirqs+0xc2/0x2c0 __irq_exit_rcu+0x74/0xd0 common_interrupt+0x7f/0x90 </IRQ> ... Kernel panic - not syncing: Fatal exception in interrupt

After taking a reference, check whether the nulls node is unhashed in both IPv4 and IPv6 established lookups. If it is unhashed or the tuple no longer matches, drop the reference and restart the lookup.

Lookups racing with the TIME_WAIT hashdance, or with a request being replaced by its child, now restart and find the new socket instead of returning the old one.

Request sockets that were never inserted into ehash can have a nonzero refcount, and a stale lookup can hold a transient reference. Therefore, when SYN cookie, Fast Open, and request migration paths fail after setting a nonzero refcount, release the references held by those paths with reqsk_put() instead of freeing the request directly.

References

4 sources

git.kernel.org/stable/c/d69100340b4cae08d40f898f1b601032403f6be6

Source referenceLinux

git.kernel.org/stable/c/8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd

Source referenceLinux

git.kernel.org/stable/c/eb8a2d156f2c1d862fffdfd1b3432bfbcd939879

Source referenceLinux

git.kernel.org/stable/c/4e2b3ef19e0e04adca38442f07dd6bc93c712bf1

Source referenceLinux

Inside the record

Evidence available

Package identity · not supplied

Version evidence

Remediation guidance · not supplied

Weakness classification · not supplied

Additional publishers · not supplied

Describes the evidence in this view, not whether the product is safe.

Original records

CVE-2026-99288

View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.

cve.new JSON →

Environment requirements

These conditions apply together as specified by the publisher. A matching product name alone does not establish exposure.

Linux · platform conditions

Any condition may hold

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 4.4

After:

Through (inclusive):

Before: 6.12.117

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 4.4

After:

Through (inclusive):

Before: 6.18.63

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 4.4

After:

Through (inclusive):

Before: 7.3.4

Vulnerable product

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

From (inclusive): 4.4

After:

Through (inclusive):

Before: 7.4-rc2

Applicability preview

[
  {
    "nodes": [
      {
        "operator": "OR",
        "negate": false,
        "cpeMatch": [
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.4",
            "versionEndExcluding": "6.12.117"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.4",
            "versionEndExcluding": "6.18.63"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.4",
            "versionEndExcluding": "7.3.4"
          },
          {
            "vulnerable": true,
            "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
            "versionStartIncluding": "4.4",
            "versionEndExcluding": "7.4-rc2"
          }
        ]
      }
    ]
  }
]

Contributing organizations · 1

Linux

Assigning organization

2026-11-13

Timeline

All times UTC

10 Nov 2026, 18:19
Advisory published
Publication date supplied by the source.
13 Nov 2026, 14:17
Source updated
Latest modification date supplied by the source.
13 Nov 2026, 22:05
Last imported by cve.new
Latest catalog import, not the date we first saw this advisory.

What changed

Follow changes

CVE · CVE-2026-992882026-11-13

Observed 2026-11-13T22:05:12.665Z · upstream updated 2026-11-13T14:17:22.151Z

Product or version evidence changed

before

[
  {
    "vendor": "Linux",
    "name": "Linux",
    "platforms": [],
    "versions": [
      {
        "version": "079096f103faca2dd87342cca6f23d4b34da8871",
        "status": "affected",
        "lessThan": "d69100340b4cae08d40f898f1b601032403f6be6",
        "versionType": "git"
      },
      {
        "version": "079096f103faca2dd87342cca6f23d4b34da8871",
        "status": "affected",
        "lessThan": "8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd",
        "versionType": "git"
      },
      {
        "version": "079096f103faca2dd87342cca6f23d4b34da8871",
        "status": "affected",
        "lessThan": "eb8a2d156f2c1d862fffdfd1b3432bfbcd939879",
        "versionType": "git"
      }
    ],
    "defaultStatus": "unaffected",
    "cpes": [],
    "source": "Linux",
    "url": "https://www.cve.org/CVERecord?id=CVE-2026-99288"
  },
  {
    "vendor": "Linux",
    "name": "Linux",
    "platforms": [],
    "versions": [
      {
        "version": "4.4",
        "status": "affected"
      },
      {
        "version": "0",
        "status": "unaffected",
        "lessThan": "4.4",
        "versionType": "semver"
      },
      {
        "version": "6.12.117",
        "status": "unaffected",
        "lessThanOrEqual": "6.12.*",
        "versionType": "semver"
      },
      {
        "version": "6.18.63",
        "status": "unaffected",
        "lessThanOrEqual": "6.18.*",
        "versionType": "semver"
      },
      {
        "version": "7.3.4",
        "status": "unaffected",
        "lessThanOrEqual": "7.3.*",
        "versionType": "semver"
      }
    ],
    "defaultStatus": "affected",
    "cpes": [],
    "source": "Linux",
    "url": "https://www.cve.org/CVERecord?id=CVE-2026-99288"
  }
]

after

[
  {
    "vendor": "Linux",
    "name": "Linux",
    "platforms": [],
    "versions": [
      {
        "version": "079096f103faca2dd87342cca6f23d4b34da8871",
        "status": "affected",
        "lessThan": "d69100340b4cae08d40f898f1b601032403f6be6",
        "versionType": "git"
      },
      {
        "version": "079096f103faca2dd87342cca6f23d4b34da8871",
        "status": "affected",
        "lessThan": "8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd",
        "versionType": "git"
      },
      {
        "version": "079096f103faca2dd87342cca6f23d4b34da8871",
        "status": "affected",
        "lessThan": "eb8a2d156f2c1d862fffdfd1b3432bfbcd939879",
        "versionType": "git"
      },
      {
        "version": "079096f103faca2dd87342cca6f23d4b34da8871",
        "status": "affected",
        "lessThan": "4e2b3ef19e0e04adca38442f07dd6bc93c712bf1",
        "versionType": "git"
      }
    ],
    "defaultStatus": "unaffected",
    "cpes": [],
    "source": "Linux",
    "url": "https://www.cve.org/CVERecord?id=CVE-2026-99288"
  },
  {
    "vendor": "Linux",
    "name": "Linux",
    "platforms": [],
    "versions": [
      {
        "version": "4.4",
        "status": "affected"
      },
      {
        "version": "0",
        "status": "unaffected",
        "lessThan": "4.4",
        "versionType": "semver"
      },
      {
        "version": "6.12.117",
        "status": "unaffected",
        "lessThanOrEqual": "6.12.*",
        "versionType": "semver"
      },
      {
        "version": "6.18.63",
        "status": "unaffected",
        "lessThanOrEqual": "6.18.*",
        "versionType": "semver"
      },
      {
        "version": "7.3.4",
        "status": "unaffected",
        "lessThanOrEqual": "7.3.*",
        "versionType": "semver"
      },
      {
        "version": "7.4-rc2",
        "status": "unaffected",
        "lessThanOrEqual": "*",
        "versionType": "original_commit_for_fix"
      }
    ],
    "defaultStatus": "affected",
    "cpes": [],
    "source": "Linux",
    "url": "https://www.cve.org/CVERecord?id=CVE-2026-99288"
  }
]

References changed

before

[
  "https://git.kernel.org/stable/c/d69100340b4cae08d40f898f1b601032403f6be6",
  "https://git.kernel.org/stable/c/8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd",
  "https://git.kernel.org/stable/c/eb8a2d156f2c1d862fffdfd1b3432bfbcd939879"
]

after

[
  "https://git.kernel.org/stable/c/d69100340b4cae08d40f898f1b601032403f6be6",
  "https://git.kernel.org/stable/c/8e5172cbd227fae32f3313cba1f3e1b9edb5c4fd",
  "https://git.kernel.org/stable/c/eb8a2d156f2c1d862fffdfd1b3432bfbcd939879",
  "https://git.kernel.org/stable/c/4e2b3ef19e0e04adca38442f07dd6bc93c712bf1"
]

Environment requirements changed

before

[
  {
    "source": "Linux",
    "statements": [
      {
        "nodes": [
          {
            "operator": "OR",
            "negate": false,
            "cpeMatch": [
              {
                "vulnerable": true,
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "4.4",
                "versionEndExcluding": "6.12.117"
              },
              {
                "vulnerable": true,
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "4.4",
                "versionEndExcluding": "6.18.63"
              },
              {
                "vulnerable": true,
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "4.4",
                "versionEndExcluding": "7.3.4"
              }
            ]
          }
        ]
      }
    ]
  }
]

after

[
  {
    "source": "Linux",
    "statements": [
      {
        "nodes": [
          {
            "operator": "OR",
            "negate": false,
            "cpeMatch": [
              {
                "vulnerable": true,
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "4.4",
                "versionEndExcluding": "6.12.117"
              },
              {
                "vulnerable": true,
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "4.4",
                "versionEndExcluding": "6.18.63"
              },
              {
                "vulnerable": true,
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "4.4",
                "versionEndExcluding": "7.3.4"
              },
              {
                "vulnerable": true,
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "versionStartIncluding": "4.4",
                "versionEndExcluding": "7.4-rc2"
              }
            ]
          }
        ]
      }
    ]
  }
]

Large field values are marked as truncated previews. Original source snapshots remain retained.

Showing up to 50 most recent observed changes.

Reading the signals

Severity · CVSS: Technical impact and attack conditions. No numeric assessment supplied.
Observed exploitation · KEV: An absent or unavailable KEV listing does not establish that exploitation has not occurred.
Predicted exploitation · EPSS: 0.15% estimated probability in the next 30 days. 2026-11-13 · FIRST EPSS.

Record identifiers

Aliases: None recorded

Source evidence

Request a correction or dispute

Start with the assigning organization for this record. Include the CVE ID, the disputed information, and supporting evidence. A dispute does not itself reject a record.

Find the responsible CNA →Official dispute and escalation process ↗

CVE CVE-2026-99288

Enrichment coverage

NVDRefresh failed

Previous evidence retained where available.

GHSAAvailable

Checked 14/11/2026, 07:25:33 UTC

EUVDAvailable

Checked 14/11/2026, 07:25:30 UTC

EPSSAvailable

Checked 14/11/2026, 07:25:30 UTC

Additional source evidence

ENISA EUVD · EUVD-2026-121963Checked 14/11/2026, 07:25:30 UTC

FIRST EPSS · CVE-2026-99288

EPSS 0.15% probability of exploitation in the next 30 days. Percentile: 4.66% · 2026-11-13

Checked 14/11/2026, 07:25:30 UTC

GitHub Advisory Database · GHSA-qmmm-94cj-pp32Checked 14/11/2026, 07:25:33 UTC

Sponsored by MoxsoBuild security habits with adaptive training and phishing simulations.View as JSON

inet: reject unhashed sockets during established lookups

Severity and exploitation

What this means

Attack conditions

Affected versions

Linux

affected

unaffected

unknown

Linux

affected

unaffected

unknown

What to do

Public exploit evidence

Original source description

References

Inside the record

Evidence available

Original records

Environment requirements

Timeline

Advisory published

Source updated

Last imported by cve.new

What changed