---
id: CVE-2026-74696
title: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tcp: fix TFO max_qlen accounting across reuseport migration

  A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through
  far more pending Fast Open request…
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  tcp: fix TFO max_qlen accounting across reuseport migration

  A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through
  far more pending Fast Open request…
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
published: '2026-08-22'
updated: '2026-10-14'
sourceUpdated: '2026-10-14T13:10:00.187'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-74696'
references:
  - url: 'https://git.kernel.org/stable/c/585fc5247d14939a561056aa2addd9b7c2b1f670'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/6e10ee56524a26b250229ad348637825646ddb88'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a0ab2ba83e35159d81cec830a92e885ecf8139be'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/a66e869cf0c90c1e47ae75f72b6482acbfc808ff'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/b6247e0f96bd825ffb2005257f6177b5e642dee6'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/d974618b2097453778389d385e3741629c40e0a3'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
  - url: 'https://git.kernel.org/stable/c/e98f0d80b9cccb5f828425d2004f9686e7d1ae24'
    label: 416baaa9-dc9f-4396-8d5f-8c081fb06d67
tags:
  - nvd
epss: 0.0049
epssPercentile: 0.40422
ingestedAt: '2026-10-14T13:30:58.540Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix TFO max_qlen accounting across reuseport migration

A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through
far more pending Fast Open requests than it was configured for.

This only shows up with SO_REUSEPORT listener migration, where closing a
listener hands its still-pending TFO children over to a surviving one.

fastopenq.qlen is charged in tcp_fastopen_create_child() when the child
is created and uncharged in reqsk_fastopen_remove() when the handshake
completes.  The uncharge follows rsk_listener of the request the child
points at, and inet_reqsk_clone() has repointed the child at a new
request owned by the new listener, so the ++ and the -- land on two
different sockets.  The new listener's qlen drifts negative and its
limit no longer binds.

Charge the new listener during migration, like reqsk_queue_migrated()
already does for queue->young and queue->qlen.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.