CVE-2026-74696
tcp: fix TFO max_qlen accounting across reuseport migration
Description
In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reuseport migration A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SO_REUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one. fastopenq.qlen is charged in tcp_fastopen_create_child() when the child is created and uncharged in reqsk_fastopen_remove() when the handshake completes. The uncharge follows rsk_listener of the request the child points at, and inet_reqsk_clone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener's qlen drifts negative and its limit no longer binds. Charge the new listener during migration, like reqsk_queue_migrated() already does for queue->young and queue->qlen.
INFO
Published Date :
Aug. 22, 2026, 4:16 p.m.
Last Modified :
Aug. 22, 2026, 4:16 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Solution
- Apply the kernel patch for TFO max_qlen accounting.
- Ensure TFO limits are correctly enforced after SO_REUSEPORT migration.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2026-74696.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2026-74696 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2026-74696
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2026-74696 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2026-74696 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
New CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Aug. 22, 2026
Action Type Old Value New Value Added Affected [{'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '54b92e84193749c9968aff2dd46e3b0f42643e18', 'lessThan': 'e98f0d80b9cccb5f828425d2004f9686e7d1ae24', 'versionType': 'git'}, {'status': 'affected', 'version': '54b92e84193749c9968aff2dd46e3b0f42643e18', 'lessThan': 'b6247e0f96bd825ffb2005257f6177b5e642dee6', 'versionType': 'git'}, {'status': 'affected', 'version': '54b92e84193749c9968aff2dd46e3b0f42643e18', 'lessThan': '585fc5247d14939a561056aa2addd9b7c2b1f670', 'versionType': 'git'}, {'status': 'affected', 'version': '54b92e84193749c9968aff2dd46e3b0f42643e18', 'lessThan': '6e10ee56524a26b250229ad348637825646ddb88', 'versionType': 'git'}, {'status': 'affected', 'version': '54b92e84193749c9968aff2dd46e3b0f42643e18', 'lessThan': 'a66e869cf0c90c1e47ae75f72b6482acbfc808ff', 'versionType': 'git'}, {'status': 'affected', 'version': '54b92e84193749c9968aff2dd46e3b0f42643e18', 'lessThan': 'd974618b2097453778389d385e3741629c40e0a3', 'versionType': 'git'}, {'status': 'affected', 'version': '54b92e84193749c9968aff2dd46e3b0f42643e18', 'lessThan': 'a0ab2ba83e35159d81cec830a92e885ecf8139be', 'versionType': 'git'}], 'programFiles': ['net/ipv4/inet_connection_sock.c'], 'defaultStatus': 'unaffected'}, {'repo': 'https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git', 'vendor': 'Linux', 'product': 'Linux', 'versions': [{'status': 'affected', 'version': '5.14'}, {'status': 'unaffected', 'version': '0', 'lessThan': '5.14', 'versionType': 'semver'}, {'status': 'unaffected', 'version': '5.15.216', 'versionType': 'semver', 'lessThanOrEqual': '5.15.*'}, {'status': 'unaffected', 'version': '6.1.183', 'versionType': 'semver', 'lessThanOrEqual': '6.1.*'}, {'status': 'unaffected', 'version': '6.6.152', 'versionType': 'semver', 'lessThanOrEqual': '6.6.*'}, {'status': 'unaffected', 'version': '6.12.104', 'versionType': 'semver', 'lessThanOrEqual': '6.12.*'}, {'status': 'unaffected', 'version': '6.18.45', 'versionType': 'semver', 'lessThanOrEqual': '6.18.*'}, {'status': 'unaffected', 'version': '7.1.9', 'versionType': 'semver', 'lessThanOrEqual': '7.1.*'}, {'status': 'unaffected', 'version': '7.2', 'versionType': 'original_commit_for_fix', 'lessThanOrEqual': '*'}], 'programFiles': ['net/ipv4/inet_connection_sock.c'], 'defaultStatus': 'affected'}] Added Description In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reuseport migration A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SO_REUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one. fastopenq.qlen is charged in tcp_fastopen_create_child() when the child is created and uncharged in reqsk_fastopen_remove() when the handshake completes. The uncharge follows rsk_listener of the request the child points at, and inet_reqsk_clone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener's qlen drifts negative and its limit no longer binds. Charge the new listener during migration, like reqsk_queue_migrated() already does for queue->young and queue->qlen. Added Reference https://git.kernel.org/stable/c/585fc5247d14939a561056aa2addd9b7c2b1f670 Added Reference https://git.kernel.org/stable/c/6e10ee56524a26b250229ad348637825646ddb88 Added Reference https://git.kernel.org/stable/c/a0ab2ba83e35159d81cec830a92e885ecf8139be Added Reference https://git.kernel.org/stable/c/a66e869cf0c90c1e47ae75f72b6482acbfc808ff Added Reference https://git.kernel.org/stable/c/b6247e0f96bd825ffb2005257f6177b5e642dee6 Added Reference https://git.kernel.org/stable/c/d974618b2097453778389d385e3741629c40e0a3 Added Reference https://git.kernel.org/stable/c/e98f0d80b9cccb5f828425d2004f9686e7d1ae24