CVE-2026-74696
In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reuseport migration A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SO_REUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one. fastopenq.qlen is charged in tcp_fastopen_create_child() when the child is created and uncharged in reqsk_fastopen_remove() when the handshake completes. The uncharge follows rsk_listener of the request the child points at, and inet_reqsk_clone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener's qlen drifts negative and its limit no longer binds. Charge the new listener during migration, like reqsk_queue_migrated() already does for queue->young and queue->qlen.
Affected versions
Linux kernel versions
5.14
and later are affected. Fixed in
5.15.216,
6.1.183,
6.6.152,
6.12.104,
6.18.45,
7.1.9,
7.2
and their respective stable series.
References
7 totalFrequently asked questions
-
What is CVE-2026-74696?
CVE-2026-74696 is a unscored severity Linux kernel vulnerability . It affects Linux kernel versions from 5.14 onward and has been patched in 5.15.216, 6.1.183, 6.6.152 and others. CVE-2026-74696 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
Is there a patch available for CVE-2026-74696?
Yes. CVE-2026-74696 has been patched. Fixed versions include 5.15.216, 6.1.183, 6.6.152 and others. If you are running Linux kernel 5.14 or later up to the fix versions, apply the relevant patch for your kernel branch.
-
Is CVE-2026-74696 actively exploited?
No. CVE-2026-74696 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.