CVE-2026-74696

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tcp: fix TFO max_qlen accounting across reuseport migration<br /> <br /> A listener&amp;#39;s TCP_FASTOPEN max_qlen stops being accurate and lets through<br /> far more pending Fast Open requests than it was configured for.<br /> <br /> This only shows up with SO_REUSEPORT listener migration, where closing a<br /> listener hands its still-pending TFO children over to a surviving one.<br /> <br /> fastopenq.qlen is charged in tcp_fastopen_create_child() when the child<br /> is created and uncharged in reqsk_fastopen_remove() when the handshake<br /> completes. The uncharge follows rsk_listener of the request the child<br /> points at, and inet_reqsk_clone() has repointed the child at a new<br /> request owned by the new listener, so the ++ and the -- land on two<br /> different sockets. The new listener&amp;#39;s qlen drifts negative and its<br /> limit no longer binds.<br /> <br /> Charge the new listener during migration, like reqsk_queue_migrated()<br /> already does for queue-&gt;young and queue-&gt;qlen.