The Linux kernel had a vulnerability in the TCP_FASTOPEN max_qlen accounting when SO_REUSEPORT listener migration occurs. Specifically, when a listener is closed and its pending Fast Open children are handed over to a surviving listener, the accounting for the queue length (fastopenq.qlen) becomes inaccurate. The increment and decrement operations for the queue length happen on different sockets due to the migration, causing the new listener's queue length to drift negative and its configured limit to be ineffective. The fix involves charging the new listener during migration, similar to how other queue accounting is handled.

The impact is that a listener can accept far more pending Fast Open requests than intended, potentially leading to resource exhaustion or denial of service conditions on the affected system. However, there is no indication of remote code execution or privilege escalation. The vulnerability affects TCP_FASTOPEN behavior specifically during SO_REUSEPORT listener migration scenarios.

A fix for this vulnerability has been implemented in the Linux kernel. Users should apply the official kernel update that includes this patch to ensure accurate TCP_FASTOPEN max_qlen accounting during SO_REUSEPORT listener migration. Since this is a kernel-level fix, upgrading to the patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the vendor advisory or kernel release notes for the exact fixed versions and update accordingly.