CVE-2026-74696
CVE CVE-2026-74696EUVD EUVD-2026-64383Published 2026-08-22T15:32:58.000ZLast changed 2026-08-25T05:41:40.000ZCVSS 7.5
What the advisory describes
In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reuseport migration A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SO_REUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one. fastopenq.qlen is charged in tcp_fastopen_create_child() when the child is created and uncharged in reqsk_fastopen_remove() when the handshake completes. The uncharge follows rsk_listener of the request the child points at, and inet_reqsk_clone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener's qlen drifts negative and its limit no longer binds. Charge the new listener during migration, like reqsk_queue_migrated() already does for queue->young and queue->qlen.
Source: EUVD (ENISA), in the words of the advisory.
Products the advisory names
These come from the advisory itself, not from any check we performed.
- Linux — Linux 54b92e84193749c9968aff2dd46e3b0f42643e18 <e98f0d80b9cccb5f828425d2004f9686e7d1ae24; patch: 7.1.9; 54b92e84193749c9968aff2dd46e3b0f42643e18 <d974618b2097453778389d385e3741629c40e0a3; patch: 6.6.152; patch: 5.15.216; patch: 6.1.183; patch: 6.18.45; 54b92e84193749c9968aff2dd46e3b0f42643e18 <a66e869cf0c90c1e47ae75f72b6482acbfc808ff; 54b92e84193749c9968aff2dd46e3b0f42643e18 <585fc5247d14939a561056aa2addd9b7c2b1f670; 54b92e84193749c9968aff2dd46e3b0f42643e18 <b6247e0f96bd825ffb2005257f6177b5e642dee6; patch: 7.2; patch: 0; 5.14; patch: 6.12.104; 54b92e84193749c9968aff2dd46e3b0f42643e18 <a0ab2ba83e35159d81cec830a92e885ecf8139be; 54b92e84193749c9968aff2dd46e3b0f42643e18 <6e10ee56524a26b250229ad348637825646ddb88
The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.
Carried in the product catalogue
An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.
- Linux — Linux
Does this concern one of your customers?
This page cannot answer that — it does not know your estate. Whoever has recorded their environments gets the answer the morning after publication, together with a paragraph they can forward to the customer unedited.
Try it for 28 daysPatchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.