# CVE-2026-99138: tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)

CVE-2026-99138 is fixed in linux on 1 platform, first by DEBIAN-CVE-2026-99138, released November 3, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-99138
- Priority: High
- CVSS: 7.8 (Important)
- EPSS: 0.0018
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 28, 2026
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-99138

## Description

In the Linux kernel, the following vulnerability has been resolved:  tcp: fix use-after-free in do_tcp_getsockopt(TCP_CC_INFO)  do_tcp_getsockopt() reads icsk->icsk_ca_ops and dereferences the get_info function pointer without rcu_read_lock(). With BPF struct_ops congestion control, ca_ops can point to dynamically allocated memory that is freed concurrently, resulting in a use-after-free when the kernel dereferences or calls through the stale pointer.    BUG: KASAN: slab-use-after-free in do_tcp_getsockopt+0x2037/0x23e0   Read of size 8 at addr ffff888013701258 by task exploit/149    do_tcp_getsockopt+0x2037/0x23e0 (net/ipv4/tcp.c:4564)    tcp_getsockopt+0x91/0xf0    __sys_getsockopt+0xf7/0x170  Fix this by wrapping the ca_ops load and get_info call within rcu_read_lock()/rcu_read_unlock(), and using READ_ONCE() to load the icsk_ca_ops pointer.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 13.5 (trixie) | 6.12.115-2 | [DEBIAN-CVE-2026-99138](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99138.md) | Nov 3, 2026 |
| Linux | linux Debian 14 | 7.2.13-1 | [DEBIAN-CVE-2026-99138](https://patchblox.com/security/data/fix/linux/debian-cve-2026-99138.md) | Nov 3, 2026 |

---

Data as of 2026-11-08T06:59:42Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.