CVE-2026-53260

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().

syzbot reported a weird reqsk->rsk_refcnt underflow in

__inet_csk_reqsk_queue_drop().

The captured reqsk_put() in __inet_csk_reqsk_queue_drop()

is called only when it successfully removes reqsk from ehash.

Moreover, reqsk_timer_handler() calls another reqsk_put()

after that.

This indicates that the reqsk was missing both refcnts for

ehash and the timer itself.

Since all the syzbot reports had PREEMPT_RT enabled, the only

possible scenario is that reqsk_queue_hash_req() is preempted

after mod_timer() and before refcount_set(), and then the timer

triggered after 1s aborts the reqsk due to its listener's close().

Let's wrap mod_timer() and refcount_set() with

preempt_disable_nested() and preempt_enable_nested().

Note that inet_ehash_insert() holds the normal spin_lock()

(mutex in PREEMPT_RT), so it must be called outside of

preempt_disable_neste

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References