VulnerabilityPublished 11 Nov 2026Updated 13 Nov 2026

CVE-2026-99288: Linux kernel · inet: reject unhashed sockets during established lookups

Affects Linux kernelSource GCVE Database

Compare

Authoritative record:CVE-2026-99288· High

Not known to be exploited.

Data as of 13 Nov 2026, 14:18 UTC

Severity

High

Rated by Threat Radar · CVSS not yet scored by NVD

Thin evidence

One scorer or none

Exploitation evidence

Disclosed: evidence found.
CVE published 10 Nov 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 13 Nov 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponized: A Metasploit exploit module or Exploit-DB entry exists (Metasploit scanner modules do not count), or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

Affected software

Product	Affected	Fixed in
Ubuntu 26.10linux`pkg:deb/ubuntu/linux?arch=source&distro=stonking`Other threats	Affected 7.0.0-14.14 – 7.3.0-10.10 7 affected builds	Fixed in–
Ubuntu 26.10linux-aws`pkg:deb/ubuntu/linux-aws?arch=source&distro=stonking`Other threats	Affected 7.0.0-1004.4 – 7.3.0-1004.4 6 affected builds	Fixed in–
Ubuntu 26.10linux-azure`pkg:deb/ubuntu/linux-azure?arch=source&distro=stonking`Other threats	Affected 7.0.0-1004.4 – 7.3.0-1004.4 6 affected builds	Fixed in–
Ubuntu 26.10linux-azure-fde`pkg:deb/ubuntu/linux-azure-fde?arch=source&distro=stonking`Other threats	Affected 7.0.0-1004.4 – 7.3.0-1004.5 4 affected builds	Fixed in–
Ubuntu 26.10linux-gcp`pkg:deb/ubuntu/linux-gcp?arch=source&distro=stonking`Other threats	Affected 7.0.0-1003.3 – 7.3.0-1004.4 6 affected builds	Fixed in–
Ubuntu 26.10linux-oracle`pkg:deb/ubuntu/linux-oracle?arch=source&distro=stonking`Other threats	Affected 7.0.0-1003.3 – 7.3.0-1004.4 6 affected builds	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

AI-suggested

A fix is available that adds checks after acquiring socket references to ensure the socket is hashed and the tuple matches. If not, the lookup restarts to find the correct socket. Users should apply the official patches or upgrade to fixed kernel versions to mitigate this issue.

Description

CVE-2026-99288 is a vulnerability in the Linux kernel's TCP established socket lookup mechanism. It arises because the kernel does not verify whether a socket object is hashed after acquiring a reference during established lookups, leading to potential use of unhashed sockets. This can cause kernel crashes due to NULL pointer dereferences when the socket's listener is NULL. The issue affects specific Linux kernel versions and has been resolved by adding checks to drop references to unhashed sockets and restart lookups.

Impact

The vulnerability can cause kernel crashes due to NULL pointer dereferences when the kernel accesses unhashed sockets during TCP established lookups. This can lead to system instability or denial of service. There is no indication of remote code execution or privilege escalation. No known exploits in the wild have been reported.

Summary

The vulnerability in the Linux kernel involves the TCP established ehash lookups, which are lockless and use SLAB_TYPESAFE_BY_RCU for socket caches. After a tuple match, the functions __inet_lookup_established() and __inet6_lookup_established() acquire a reference and recheck the tuple but do not verify if the new socket object is hashed. If the address is reused for a socket with the same tuple but unhashed, the lookup may return a reference to this unhashed socket. This leads to kernel NULL pointer dereference crashes, as demonstrated by a proof-of-concept involving SYN cookie request sockets. The fix involves checking if the nulls node is unhashed after taking a reference and restarting the lookup if so, preventing stale or unhashed sockets from being returned.

GCVE source: db.gcve.eu
OSV ID: UBUNTU-CVE-2026-99288
Osv Schema Version: 1.7.0
Ecosystems: Ubuntu:Pro:14.04:LTS, Ubuntu:Pro:16.04:LTS, Ubuntu:16.04:LTS, Ubuntu:Pro:FIPS-updates:16.04:LTS, Ubuntu:Pro:FIPS:16.04:LTS, Ubuntu:Pro:18.04:LTS, Ubuntu:18.04:LTS, Ubuntu:Pro:FIPS-updates:18.04:LTS, Ubuntu:Pro:FIPS:18.04:LTS, Ubuntu:Pro:20.04:LTS, Ubuntu:20.04:LTS, Ubuntu:Pro:FIPS-updates:20.04:LTS, Ubuntu:Pro:FIPS:20.04:LTS, Ubuntu:22.04:LTS, Ubuntu:Nvidia-BlueField:22.04:LTS, Ubuntu:Pro:Realtime:22.04:LTS, Ubuntu:Pro:FIPS-preview:22.04:LTS, Ubuntu:Pro:FIPS-updates:22.04:LTS, Ubuntu:24.04:LTS, Ubuntu:Nvidia-BlueField:24.04:LTS, Ubuntu:Pro:Realtime:24.04:LTS, Ubuntu:Pro:FIPS-updates:24.04:LTS, Ubuntu:26.10, Ubuntu:26.04:LTS

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Nov 2026, 14:18 UTC

Technical details

References

Community reviews

Related threats