EUVD-2026-64383
GHSA-vp9r-6w4f-8wmq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
AC:H reflects the non-default prerequisite that SO_REUSEPORT listener migration must have already occurred before exploitation is possible; remaining metrics align with network-accessible unauthenticated resource exhaustion with no confidentiality or integrity impact.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
5DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix TFO max_qlen accounting across reuseport migration
A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for.
This only shows up with SO_REUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one.
fastopenq.qlen is charged in tcp_fastopen_create_child() when the child is created and uncharged in reqsk_fastopen_remove() when the handshake completes. The uncharge follows rsk_listener of the request the child points at, and inet_reqsk_clone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener's qlen drifts negative and its limit no longer binds.
Charge the new listener during migration, like reqsk_queue_migrated() already does for queue->young and queue->qlen.
AnalysisAI
TCP Fast Open queue accounting in the Linux kernel becomes inaccurate following SO_REUSEPORT listener migration, permitting far more pending TFO connection requests than the configured TCP_FASTOPEN max_qlen limit allows. The root cause is a counter mismatch: fastopenq.qlen is charged against the original listener during child creation in tcp_fastopen_create_child() but uncharged against a different socket after inet_reqsk_clone() repoints the migrated child's rsk_listener to the new listener, causing the surviving listener's qlen to drift negative and its max_qlen guard to stop firing. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires two non-default conditions to be satisfied simultaneously: the target server must have TCP Fast Open explicitly enabled (via the net.ipv4.tcp_fastopen sysctl or the TCP_FASTOPEN socket option on the listener) AND must be operating with SO_REUSEPORT listener groups where at least one listener has been closed while holding pending TFO children, causing those children to migrate to a surviving listener. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The NVD CVSS vector AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H yields a score of 7.5, but AC:L materially overstates exploitability: the vulnerability only manifests after SO_REUSEPORT listener migration has already occurred, a non-default, operationally specific event that an external attacker cannot independently trigger. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An operator running a high-throughput TLS termination service with both SO_REUSEPORT and TCP Fast Open enabled performs a rolling restart, closing one listener socket while others remain active. The pending TFO children migrate to the surviving listener, causing its fastopenq.qlen to drift negative. … |
| Remediation | Upgrade to a patched Linux kernel version corresponding to the active stable branch in use: 5.15.216, 6.1.183, 6.6.152, 6.12.104, 6.18.45, 7.1.9, or 7.2. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify the scope of Linux systems in your infrastructure and check vendor advisories for affected kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today