CVE-2026-98374
Description
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack. tp->retransmit_skb_hint keeps pointing at the freed skbuff_fclone_cache object. The dangling hint is read in tcp_verify_retransmit_hint() and used as the root of the rbtree walk in tcp_xmit_retransmit_queue(). An unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with an attacker-supplied ICMP fragmentation-needed message, after which a simultaneous open frees the armed SYN skb: BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) Read of size 4 at addr ffff88800604d928 by task swapper/1/0 Call Trace: tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) tcp_simple_retransmit (net/ipv4/tcp_input.c:3158) tcp_v4_err (net/ipv4/tcp_ipv4.c:587) Sync the hint to the copy.
How to fix
- Linux Linuxfad6d429651e748365e93ca54645accc212f0018, c5b4da1f403a658c1c19766be2b426003ada419f, 71d45049b0d631dfdbf3c65305f7fca676de023b, e3ea71cb1408a013ed4e8a757b815f1a919324bd, 631aa4cb45099f09e9385dd786bd291c6270bfc4, 0f87720c7e4bcab07c24888b3cf12bfe857bb90e, fe99bbeee5c5dbd3abc30721a8079ced59649d97 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | c31b70c9968fe9c4194d1b5d06d07596a3b680de ≤ v < fad6d429651e748365e93ca54645accc212f0018, c31b70c9968fe9c4194d1b5d06d07596a3b680de ≤ v < c5b4da1f403a658c1c19766be2b426003ada419f, c31b70c9968fe9c4194d1b5d06d07596a3b680de ≤ v < 71d45049b0d631dfdbf3c65305f7fca676de023b, c31b70c9968fe9c4194d1b5d06d07596a3b680de ≤ v < e3ea71cb1408a013ed4e8a757b815f1a919324bd, c31b70c9968fe9c4194d1b5d06d07596a3b680de ≤ v < 631aa4cb45099f09e9385dd786bd291c6270bfc4, c31b70c9968fe9c4194d1b5d06d07596a3b680de ≤ v < 0f87720c7e4bcab07c24888b3cf12bfe857bb90e, c31b70c9968fe9c4194d1b5d06d07596a3b680de ≤ v < fe99bbeee5c5dbd3abc30721a8079ced59649d97, 5.11 | fad6d429651e748365e93ca54645accc212f0018, c5b4da1f403a658c1c19766be2b426003ada419f, 71d45049b0d631dfdbf3c65305f7fca676de023b, e3ea71cb1408a013ed4e8a757b815f1a919324bd, 631aa4cb45099f09e9385dd786bd291c6270bfc4, 0f87720c7e4bcab07c24888b3cf12bfe857bb90e, fe99bbeee5c5dbd3abc30721a8079ced59649d97 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.