CVE-2026-74696: Linux Kernel TCP Fast Open DoS Vulnerability

CVE-2026-74696 Overview

CVE-2026-74696 is a Linux kernel networking flaw in the TCP Fast Open (TFO) subsystem. A listener's TCP_FASTOPENmax_qlen accounting becomes inaccurate when SO_REUSEPORT listener migration hands still-pending TFO children from a closing listener to a surviving one. The fastopenq.qlen counter is charged on the original listener but uncharged on the new one, causing the new listener's queue length to drift negative. Once negative, the configured limit no longer binds, and the listener accepts far more pending Fast Open requests than intended. Remote attackers can exploit this behavior to exhaust server resources and degrade service availability.

Critical Impact
Remote, unauthenticated attackers can bypass the TFO pending-request limit on migrated listeners, enabling resource exhaustion and denial of service against Linux servers using SO_REUSEPORT with TCP Fast Open.

Affected Products

Linux kernel versions containing the SO_REUSEPORT listener migration TFO path (see kernel.org stable commits for exact ranges)
Distributions shipping the affected upstream kernel prior to the fix commits
Server workloads that combine SO_REUSEPORT listener migration with TCP_FASTOPEN

Discovery Timeline

2026-08-22 - CVE-2026-74696 published to NVD
2026-08-25 - Last updated in NVD database

Technical Details for CVE-2026-74696

Vulnerability Analysis

The defect resides in how the Linux kernel accounts pending TCP Fast Open children across SO_REUSEPORT listener migration. When a listener closes, its still-pending TFO children are transferred to a surviving listener in the reuseport group. However, the charge-and-uncharge lifecycle of fastopenq.qlen does not follow that transfer.

tcp_fastopen_create_child() increments fastopenq.qlen on the original listener at child creation. reqsk_fastopen_remove() later decrements the counter, but it does so against rsk_listener of the request the child now references. Because inet_reqsk_clone() repoints the child at a new request owned by the new listener, the increment lands on one socket and the decrement on another.

Over repeated migrations, the new listener's qlen drifts negative. Once negative, the configured max_qlen limit no longer restricts pending TFO requests, allowing unbounded queue growth on that listener.

Root Cause

The root cause is asymmetric accounting: fastopenq.qlen is charged during child creation on the original listener but not re-charged on the destination listener during reuseport migration. reqsk_queue_migrated() already migrates queue->young and queue->qlen, but the TFO queue counter was not included. The fix charges the new listener during migration so increments and decrements land on the same socket.

Attack Vector

A remote unauthenticated attacker sends TCP Fast Open connection attempts to a server that uses SO_REUSEPORT with listener churn (for example, rolling restarts or graceful reloads of a multi-process service). Repeated migrations skew fastopenq.qlen negative on surviving listeners. The attacker then floods pending TFO requests beyond the intended max_qlen, consuming kernel memory and half-open request state until service is degraded or denied. No authentication or user interaction is required, and only availability is impacted.

No verified public exploit code is available. See the upstream fix commits referenced below for technical details.

Detection Methods for CVE-2026-74696

Indicators of Compromise

Unexpectedly high volume of pending TFO requests on a listener beyond its configured TCP_FASTOPENmax_qlen
Sustained SYN-with-TFO-cookie bursts from a narrow set of source addresses following listener restart events
Kernel socket statistics showing fastopenq.qlen values inconsistent with configured limits

Detection Strategies

Instrument servers with ss -lnt and nstat (TcpExtTCPFastOpen*) to baseline TFO acceptance and pending request rates per listener
Correlate SO_REUSEPORT listener migration events (process restarts, graceful reloads) with subsequent TFO request spikes
Use eBPF probes on tcp_fastopen_create_child, reqsk_fastopen_remove, and reqsk_queue_migrated to observe asymmetric qlen accounting

Monitoring Recommendations

Alert on sustained increases in half-open request counts against services using TFO with SO_REUSEPORT
Track kernel version inventory to identify hosts still running vulnerable builds
Monitor for network-level TFO abuse patterns such as high-rate SYN+data floods with reused cookies

How to Mitigate CVE-2026-74696

Immediate Actions Required

Update the Linux kernel to a stable release containing the fix commits published on kernel.org
Prioritize patching servers that combine SO_REUSEPORT listener migration with TCP_FASTOPEN for public-facing workloads
If patching is delayed, disable TCP Fast Open on affected listeners as a temporary control

Patch Information

The fix charges the new listener's fastopenq.qlen during reuseport migration, aligning it with the existing migration of queue->young and queue->qlen. Apply the upstream commits from your distribution vendor or backport them from the mainline references: Kernel Git Commit 585fc52, Kernel Git Commit 6e10ee5, Kernel Git Commit a0ab2ba, Kernel Git Commit a66e869, Kernel Git Commit b6247e0, Kernel Git Commit d974618, and Kernel Git Commit e98f0d8.

Workarounds

Disable TCP Fast Open globally by setting net.ipv4.tcp_fastopen=0 via sysctl until the kernel is patched
Avoid frequent SO_REUSEPORT listener churn on services that enable TFO, since migration is required to trigger the accounting drift
Enforce network-layer rate limiting on TFO SYN traffic to reduce the practical impact of queue-limit bypass

bash

# Temporarily disable TCP Fast Open until the kernel is patched
sudo sysctl -w net.ipv4.tcp_fastopen=0
echo 'net.ipv4.tcp_fastopen = 0' | sudo tee /etc/sysctl.d/99-disable-tfo.conf
sudo sysctl --system