[SRU][Q][PATCH 0/1] CVE-2026-53260

[Cengiz Can]

https://ubuntu.com/security/CVE-2026-53260

[ Impact ]

A race condition exists in reqsk_queue_hash_req() in the TCP stack. On
PREEMPT_RT kernels, the function can be preempted between mod_timer() and
refcount_set(), allowing the request socket timer to fire and abort the reqsk
before its refcounts are initialized. This leads to a refcount underflow and
use-after-free of the request socket, which an attacker could exploit to
compromise the system (CVSS 9.8).

[ Fix ]

questing: backported with AI-assisted adaptation

[ Test Plan ]

Boot tested.

[ Where Problems Could Occur ]

A mistake in this fix could disrupt TCP request socket handling in the inet
connection sock subsystem, potentially causing incorrect timer or refcount
behavior during connection establishment, which may result in dropped
connections or socket leaks.