CVE-2026-74696

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix TFO max_qlen accounting across reuseport migration

A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through

far more pending Fast Open requests than it was configured for.

This only shows up with SO_REUSEPORT listener migration, where closing a

listener hands its still-pending TFO children over to a surviving one.

fastopenq.qlen is charged in tcp_fastopen_create_child() when the child

is created and uncharged in reqsk_fastopen_remove() when the handshake

completes. The uncharge follows rsk_listener of the request the child

points at, and inet_reqsk_clone() has repointed the child at a new

request owned by the new listener, so the ++ and the -- land on two

different sockets. The new listener's qlen drifts negative and its

limit no longer binds.

Charge the new listener during migration, like reqsk_queue_migrated()

already does for queue->young and queue->qlen.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References