Executive brief
The Linux kernel's TCP Fast Open (TFO) feature allows connection establishments to be expedited, with a configured limit on pending open requests. A flaw in how listener sockets migrate between processes (via SO_REUSEPORT) causes the accounting for these pending requests to become inaccurate, allowing attackers to bypass the configured limit and send far more unfinished connections than intended. This can lead to resource exhaustion and denial of service on affected servers.
Technical details
This is an accounting/validation bypass vulnerability in the Linux kernel's TCP Fast Open (TFO) implementation, specifically in the inet_reqsk_clone() function. When a listener socket is closed and hands off its pending TFO child connections to a surviving listener (via SO_REUSEPORT migration), the fastopenq.qlen accounting counter is incremented when a child is created in tcp_fastopen_create_child() but decremented when the handshake completes in reqsk_fastopen_remove(). However, after inet_reqsk_clone() repoints the child to the new listener, the increment and decrement operations occur on different socket objects. The new listener's qlen counter drifts negative, causing its configured max_qlen limit to become ineffective. An attacker with network access can exploit this by establishing numerous TFO connections that are not properly rate-limited, leading to resource exhaustion. The fix involves explicitly charging the new listener's fastopenq during migration, similar to how queue->young and queue->qlen are already handled.
Affected products
- Linux Linux kernel 4.15 and later (affected by TFO reuseport migration feature introduced in commit 54b92e841937)
Timeline
- 2026-08-22: disclosed
- 2026-08-19: patched: Kernel patch merged; available in stable kernels