CVE-2026-74696 tcp: fix TFO max_qlen accounting across reuseport migration

What is CVE-2026-74696?

CVE-2026-74696 is a high-severity denial of service vulnerability in Linux, published on 22 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix TFO max_qlen accounting across reuseport migration

A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for.

This only shows up with SO_REUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one.

fastopenq.qlen is charged in tcp_fastopen_create_child() when the child is created and uncharged in reqsk_fastopen_remove() when the handshake completes. The uncharge follows rsk_listener of the request the child points at, and inet_reqsk_clone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener's qlen drifts negative and its limit no longer binds.

Charge the new listener during migration, like reqsk_queue_migrated() already does for queue->young and queue->qlen.

Which versions are affected by CVE-2026-74696?

How do I fix CVE-2026-74696?

Apply the vendor's patch.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2026-74696 being exploited?

There is no known exploitation of CVE-2026-74696 in the wild and no public exploit code.

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-97110, BELL-CVE-2026-74696, DEBIAN-CVE-2026-74696, GHSA-vp9r-6w4f-8wmq, UBUNTU-CVE-2026-74696.