Linux Kernel EUVD-2026-102025

Primary issue: a remote attacker targeting any listening TCP/IPv4 socket under the default SYN_RECV ehash path (present since commit 079096f103fa), but exploitation is LIMITED by a hard concurrency requirement - the attacker must win a race on a multi-CPU system between tcp_v4_send_synack()/inet_csk_route_req() reading ireq->ireq_opt under RCU and the child socket freeing inet_opt via a non-RCU kfree() in inet_sock_destruct(). A distinct variant requires the non-default request-socket migration feature, i.e. net.ipv4.tcp_migrate_req=1 or an attached BPF_SK_REUSEPORT_SELECT_OR_MIGRATE program, where inet_reqsk_clone() shares ireq_opt and tcp_v4_reqsk_destructor() frees it with a plain kfree(). IPv6 is NOT affected by the primary issue because tcp_v6_syn_recv_sock() duplicates the options (the IPv6 CALIPSO migration case is deferred to a separate patch). No authentication or user interaction is needed, but timing precision, SMP hardware, and (for the migration path) non-default configuration meaningfully constrain real-world exploitation.

Signals conflict and must be weighed carefully. The input CVSS is 9.8 with AV:N/AC:L/PR:N/UI:N, implying trivial remote unauthenticated compromise, but the description itself makes clear the bug is a concurrency race: it is only reached when 'another cpu can concurrently process a retransmitted SYN for the same request socket' while a child socket is being created or freed. That contradicts AC:L - a reliable trigger requires winning a tight timing window on an SMP system, so real-world exploitability is considerably lower than 9.8 suggests (I assess AC:H). Corroborating this, EPSS is only 0.17% (5th percentile), there is no CISA KEV listing (not actively exploited), and no public exploit identified at time of analysis - the references are kernel.org fix commits and a VulDB advisory, not working exploit code. The one signal pushing urgency up is the vuln.today 'act_now' Decision label and the fact that this is a use-after-free in the Linux kernel's core TCP/IPv4 path, which is network-reachable on any listening socket. Net assessment: this is a legitimately serious kernel memory-safety bug that should be patched promptly per the act_now label, but it is a race-dependent UAF with very low observed exploitation probability, not a turnkey remote-code-execution emergency; the 9.8/AC:L rating overstates practical ease of exploitation.

A remote attacker sends a SYN to a listening TCP service and then races a retransmitted SYN so that one CPU builds/sends a SYNACK (reading ireq->ireq_opt under RCU) while another CPU creates or frees the child socket, whose inet_opt is freed with a plain kfree() lacking an RCU grace period. Winning this window produces a use-after-free in ip_options_build(), which can crash the kernel or corrupt memory. No public exploit code is identified; successful exploitation requires an SMP host and precise timing.