All vulnerabilities
CVE-2026-98374

Linux: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
NoneNot scored
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.16%Chance of exploitation activity in the next 30 days, higher than 4% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in71d45049b0d631dfdbf3c65305f7fca676de023bAlso 631aa4cb45099f09e9385dd786bd291c6270bfc4, 0f87720c7e4bcab07c24888b3cf12bfe857bb90eCVE List
Published7 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 71d45049b0d631dfdbf3c65305f7fca676de023bLinuxCVE List
  • 631aa4cb45099f09e9385dd786bd291c6270bfc4LinuxCVE List
  • 0f87720c7e4bcab07c24888b3cf12bfe857bb90eLinuxCVE List

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack. tp->retransmit_skb_hint keeps pointing at the freed skbuff_fclone_cache object.

The dangling hint is read in tcp_verify_retransmit_hint() and used as the root of the rbtree walk in tcp_xmit_retransmit_queue(). An unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with an attacker-supplied ICMP fragmentation-needed message, after which a simultaneous open frees the armed SYN skb:

BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) Read of size 4 at addr ffff88800604d928 by task swapper/1/0 Call Trace: tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) tcp_simple_retransmit (net/ipv4/tcp_input.c:3158) tcp_v4_err (net/ipv4/tcp_ipv4.c:587)

Sync the hint to the copy.

Text from CVE List

Affected versions 16

  • Linuxaffected: c31b70c9968fe9c4194d1b5d06d07596a3b680de before fad6d429651e748365e93ca54645accc212f0018CVE List
  • Linuxaffected: c31b70c9968fe9c4194d1b5d06d07596a3b680de before c5b4da1f403a658c1c19766be2b426003ada419fCVE List
  • Linuxaffected: c31b70c9968fe9c4194d1b5d06d07596a3b680de before 71d45049b0d631dfdbf3c65305f7fca676de023bCVE List
  • Linuxaffected: c31b70c9968fe9c4194d1b5d06d07596a3b680de before e3ea71cb1408a013ed4e8a757b815f1a919324bdCVE List
  • Linuxaffected: c31b70c9968fe9c4194d1b5d06d07596a3b680de before 631aa4cb45099f09e9385dd786bd291c6270bfc4CVE List
  • Linuxaffected: c31b70c9968fe9c4194d1b5d06d07596a3b680de before 0f87720c7e4bcab07c24888b3cf12bfe857bb90eCVE List
  • Linuxaffected: c31b70c9968fe9c4194d1b5d06d07596a3b680de before fe99bbeee5c5dbd3abc30721a8079ced59649d97CVE List
  • Linuxaffected: 5.11CVE List
  • Linuxunaffected: all versions before 5.11CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.55 through 6.18.*CVE List
  • Linuxunaffected: 7.2.9 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 7