Answer in brief
CVE-2026-74696 records a Unknown severity vulnerability in tcp: fix TFO max_qlen accounting across reuseport migration. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=54b92e84193749c9968aff2dd46e3b0f42643e18 <e98f0d80b9cccb5f828425d2004f9686e7d1ae24 || >=54b92e84193749c9968aff2dd46e3b0f42643e18 <b6247e0f96bd825ffb2005257f6177b5e642dee6 || >=54b92e84193749c9968aff2dd46e3b0f42643e18 <585fc5247d14939a561056aa2addd9b7c2b1f670 || >=54b92e84193749c9968aff2dd46e3b0f42643e18 <6e10ee56524a26b250229ad348637825646ddb88 || >=54b92e84193749c9968aff2dd46e3b0f42643e18 <a66e869cf0c90c1e47ae75f72b6482acbfc808ff || >=54b92e84193749c9968aff2dd46e3b0f42643e18 <d974618b2097453778389d385e3741629c40e0a3 || >=54b92e84193749c9968aff2dd46e3b0f42643e18 <a0ab2ba83e35159d81cec830a92e885ecf8139be | e98f0d80b9cccb5f828425d2004f9686e7d1ae24, b6247e0f96bd825ffb2005257f6177b5e642dee6, 585fc5247d14939a561056aa2addd9b7c2b1f670, 6e10ee56524a26b250229ad348637825646ddb88, a66e869cf0c90c1e47ae75f72b6482acbfc808ff, d974618b2097453778389d385e3741629c40e0a3, a0ab2ba83e35159d81cec830a92e885ecf8139be |
| Linux/Linuxgeneric | 5.14 | Not reported |
Published upstream
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 22, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 22, 2026
In the Linux kernel, the following vulnerability has been resolved: tcp: fix TFO max_qlen accounting across reuseport migration A listener's TCP_FASTOPEN max_qlen stops being accurate and lets through far more pending Fast Open requests than it was configured for. This only shows up with SO_REUSEPORT listener migration, where closing a listener hands its still-pending TFO children over to a surviving one. fastopenq.qlen is charged in tcp_fastopen_create_child() when the child is created and uncharged in reqsk_fastopen_remove() when the handshake completes. The uncharge follows rsk_listener of the request the child points at, and inet_reqsk_clone() has repointed the child at a new request owned by the new listener, so the ++ and the -- land on two different sockets. The new listener's qlen drifts negative and its limit no longer binds. Charge the new listener during migration, like reqsk_queue_migrated() already does for queue->young and queue->qlen.
Quoted source text, attributed separately from HOL analysis.