In the Linux kernel, the following vulnerability has been resolved:
tcp: Don't call reqsk_fastopen_remove() in tcp_conn_request().
syzbot reported the splat below in tcp_conn_request(). [0]
If a listener is close()d while a TFO socket is being processed in tcp_conn_request(), inet_csk_reqsk_queue_add() does not set reqsk->sk and calls inet_child_forget(), which calls tcp_disconnect() for the TFO socket.
After the cited commit, tcp_disconnect() calls reqsk_fastopen_remove(), where reqsk_put() is called due to !reqsk->sk.
Then, reqsk_fastopen_remove() in tcp_conn_request() decrements the last req->rsk_refcnt and frees reqsk, and __reqsk_free() at the drop_and_free label causes the refcount underflow for the listener and double-free of the reqsk.
Let's remove reqsk_fastopen_remove() in tcp_conn_request().
Note that other callers make sure tp->fastopen_rsk is not NULL.
[0]: refcount_t: underflow; use-after-free. WARNING: CPU: 12 PID: 5563 at lib/refcount.c:28 refcount_warn_saturate (lib/refcount.c:28) Modules linked in: CPU: 12 UID: 0 PID: 5563 Comm: syz-executor Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 RIP: 0010:refcount_warn_saturate (lib/refcount.c:28) Code: ab e8 8e b4 98 ff 0f 0b c3 cc cc cc cc cc 80 3d a4 e4 d6 01 00 75 9c c6 05 9b e4 d6 01 01 48 c7 c7 e8 df fb ab e8 6a b4 98 ff <0f> 0b e9 03 5b 76 00 cc 80 3d 7d e4 d6 01 00 0f 85 74 ff ff ff c6 RSP: 0018:ffffa79fc0304a98 EFLAGS: 00010246 RAX: d83af4db1c6b3900 RBX: ffff9f65c7a69020 RCX: d83af4db1c6b3900 RDX: 0000000000000000 RSI: 00000000ffff7fff RDI: ffffffffac78a280 RBP: 000000009d781b60 R08: 0000000000007fff R09: ffffffffac6ca280 R10: 0000000000017ffd R11: 0000000000000004 R12: ffff9f65c7b4f100 R13: ffff9f65c7d23c00 R14: ffff9f65c7d26000 R15: ffff9f65c7a64ef8 FS: 00007f9f962176c0(0000) GS:ffff9f65fcf00000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000200000000180 CR3: 000000000dbbe006 CR4: 0000000000372ef0 Call Trace: <IRQ> tcp_conn_request (./include/linux/refcount.h:400 ./include/linux/refcount.h:432 ./include/linux/refcount.h:450 ./include/net/sock.h:1965 ./include/net/request_sock.h:131 net/ipv4/tcp_input.c:7301) tcp_rcv_state_process (net/ipv4/tcp_input.c:6708) tcp_v6_do_rcv (net/ipv6/tcp_ipv6.c:1670) tcp_v6_rcv (net/ipv6/tcp_ipv6.c:1906) ip6_protocol_deliver_rcu (net/ipv6/ip6_input.c:438) ip6_input (net/ipv6/ip6_input.c:500) ipv6_rcv (net/ipv6/ip6_input.c:311) __netif_receive_skb (net/core/dev.c:6104) process_backlog (net/core/dev.c:6456) __napi_poll (net/core/dev.c:7506) net_rx_action (net/core/dev.c:7569 net/core/dev.c:7696) handle_softirqs (kernel/softirq.c:579) do_softirq (kernel/softirq.c:480) </IRQ>
CVSS Details
- CVSS 3.1 Base Score: 8.1
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon_linux_2023 | — | Upgrade kernel-modules-extra-commonUpgrade kernel-headersUpgrade perfUpgrade perf-debuginfoUpgrade kernel-develUpgrade kernel-tools-develUpgrade kernel-libbpf-debuginfoUpgrade kernel-toolsUpgrade kernel-debuginfo-common-aarch64Upgrade python3-perfUpgrade kernel-livepatch-6.1.156-177.286Upgrade bpftoolUpgrade kernel-modules-extraUpgrade kernel-libbpfUpgrade kernel-debuginfoUpgrade kernelUpgrade kernel-debuginfo-common-x86_64Upgrade bpftool-debuginfoUpgrade kernel-tools-debuginfoUpgrade kernel-libbpf-staticUpgrade kernel-libbpf-develUpgrade python3-perf-debuginfo | Dec 9, 2025 | Nov 12, 2025 |
| Debian | — | Upgrade linux-6.1Upgrade linux | Nov 14, 2025 | Nov 14, 2025 |
| Huawei Euleros 2_0_sp11 | — | Upgrade python3-perfUpgrade kernelUpgrade kernel-tools-libsUpgrade kernel-abi-stablelistsUpgrade kernel-toolsUpgrade bpftool | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp12 | — | Upgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernel-tools-libsUpgrade bpftoolUpgrade python3-perfUpgrade kernel | Mar 17, 2026 | Mar 17, 2026 |
| Huawei Euleros 2_0_sp13 | — | Upgrade bpftoolUpgrade kernel-tools-libsUpgrade kernel-toolsUpgrade kernel-abi-stablelistsUpgrade kernelUpgrade python3-perf | Mar 10, 2026 | Mar 10, 2026 |
| Oracle_linux | — | Upgrade kernel-uek | Dec 15, 2025 | Nov 12, 2025 |
| Redhat_linux | — | Upgrade kernelUpgrade kernel-rtNo solution exists | Dec 2, 2025 | Nov 12, 2025 |
| Ubuntu | — | Upgrade linux-image-6.17.0-1007-awsUpgrade linux-image-aws-64k-6.17Upgrade linux-image-raspiUpgrade linux-image-6.17.0-1007-oracle-64kUpgrade linux-image-azureUpgrade linux-image-generic-64k-6.17Upgrade linux-image-oracle-64k-6.17Upgrade linux-image-6.17.0-1007-gcp-64kUpgrade linux-image-6.17.0-14-genericUpgrade linux-image-gcp-64kUpgrade linux-image-oem-6.17Upgrade linux-image-generic-64kUpgrade linux-image-6.17.0-1008-azureUpgrade linux-image-azure-6.17Upgrade linux-image-gcp-64k-6.17Upgrade linux-image-awsUpgrade linux-image-realtime-6.17Upgrade linux-image-oracle-6.17Upgrade linux-image-6.17.0-1007-gcpUpgrade linux-image-6.17.0-1008-raspiUpgrade linux-image-6.17.0-1006-realtimeUpgrade linux-image-oracle-64kUpgrade linux-image-genericUpgrade linux-image-aws-64kUpgrade linux-image-6.17.0-1011-oemUpgrade linux-image-gcpUpgrade linux-image-6.17.0-1007-aws-64kUpgrade linux-image-realtimeUpgrade linux-image-raspi-6.17Upgrade linux-image-6.17.0-1007-oracleUpgrade linux-image-gcp-6.17Upgrade linux-image-oracleUpgrade linux-image-6.17.0-14-generic-64kUpgrade linux-image-aws-6.17Upgrade linux-image-virtual-6.17Upgrade linux-image-virtualUpgrade linux-image-generic-6.17 | Feb 13, 2026 | Feb 12, 2026 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub