Linux Kernel CVE-2026-99270

Not a default-configuration remote flaw: the UAF path is reached only when TCP request-socket migration is in use (SO_REUSEPORT listeners with reuseport/BPF migration, which depends on the non-default net.ipv4.tcp_migrate_req sysctl being enabled) AND a socket migration attempt fails specifically at inet_ehash_insert() in reqsk_timer_handler(), leaving the new reqsk freed with its timer not stopped. The trigger is thus a race in the original reqsk's timer context against a migration-failure window - described in the source as a potential/regression condition, not a guaranteed-controllable one. Limiting factors: requires the migration feature to be enabled (non-default), requires forcing the ehash-insert failure, and requires winning the timer race (reflected as AC:H). No authentication is required per PR:N, but the configuration dependency substantially narrows the realistically exploitable population.

Signals point to a genuine but non-urgent kernel memory-safety issue rather than an active-exploitation emergency. The CVSS 3.1 base score is 8.1 (AV:N/AC:H/PR:N/UI:N, full C:H/I:H/A:H), so it is remotely reachable without authentication but carries AC:H, reflecting that the use-after-free depends on a TCP socket-migration failure window that is not reliably attacker-controlled. No EPSS probability was supplied in the input, there is no CISA KEV listing, and no PoC or exploit reference is present, so there is no public exploit identified at time of analysis. The vuln.today decision label is 'this_week' (not act_now/emergency), which is consistent with a high-severity-but-no-observed-exploitation profile: a real priority to schedule, not a drop-everything incident. Note the conflict worth verifying: the 'Information Disclosure' tag understates the issue, since the CVSS vector and the UAF nature indicate full integrity/availability impact (potential kernel memory corruption / code execution), not merely disclosure. Also, exploitation realistically requires a non-default socket-migration configuration, which further lowers practical risk below what the raw 8.1 suggests.

A remote attacker repeatedly opens TCP connections against a listener that uses SO_REUSEPORT with BPF-driven request-socket migration, driving a migration attempt that fails at inet_ehash_insert() so the new request socket is freed while its timer is still pending. Racing that window, the attacker causes the stale timer to fire against the freed reqsk, yielding a use-after-free in kernel context that can corrupt kernel memory. No public PoC or exploit code is present in the provided data, and the AC:H rating reflects the narrow, migration-failure-dependent race required to trigger it reliably.