CVE-2026-98374

tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

State: Published
Severity: 8.8 High
Published: Oct 7, 2026
Updated: Oct 24, 2026
Reserved: Sep 25, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack. tp->retransmit_skb_hint keeps pointing at the freed skbuff_fclone_cache object.

The dangling hint is read in tcp_verify_retransmit_hint() and used as the root of the rbtree walk in tcp_xmit_retransmit_queue(). An unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with an attacker-supplied ICMP fragmentation-needed message, after which a simultaneous open frees the armed SYN skb:

BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) Read of size 4 at addr ffff88800604d928 by task swapper/1/0 Call Trace: tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) tcp_simple_retransmit (net/ipv4/tcp_input.c:3158) tcp_v4_err (net/ipv4/tcp_ipv4.c:587)

Sync the hint to the copy.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	c31b70c9968fe9c4194d1b5d06d07596a3b680de to before fad6d429651e748365e93ca54645accc212f0018Affected c31b70c9968fe9c4194d1b5d06d07596a3b680de to before c5b4da1f403a658c1c19766be2b426003ada419fAffected c31b70c9968fe9c4194d1b5d06d07596a3b680de to before 71d45049b0d631dfdbf3c65305f7fca676de023bAffected c31b70c9968fe9c4194d1b5d06d07596a3b680de to before e3ea71cb1408a013ed4e8a757b815f1a919324bdAffected c31b70c9968fe9c4194d1b5d06d07596a3b680de to before 631aa4cb45099f09e9385dd786bd291c6270bfc4Affected c31b70c9968fe9c4194d1b5d06d07596a3b680de to before 0f87720c7e4bcab07c24888b3cf12bfe857bb90eAffected c31b70c9968fe9c4194d1b5d06d07596a3b680de to before fe99bbeee5c5dbd3abc30721a8079ced59649d97Affected
LinuxLinux	5.11Affected before 5.11Not affected 5.15.222 through 5.15.Not affected 6.1.189 through 6.1.Not affected 6.6.158 through 6.6.Not affected 6.12.112 through 6.12.Not affected 6.18.55 through 6.18.Not affected 7.2.9 through 7.2.Not affected 7.3 and laterNot affected

Product

Versions

LinuxLinux

c31b70c9968fe9c4194d1b5d06d07596a3b680de to before fad6d429651e748365e93ca54645accc212f0018Affected
c31b70c9968fe9c4194d1b5d06d07596a3b680de to before c5b4da1f403a658c1c19766be2b426003ada419fAffected
c31b70c9968fe9c4194d1b5d06d07596a3b680de to before 71d45049b0d631dfdbf3c65305f7fca676de023bAffected
c31b70c9968fe9c4194d1b5d06d07596a3b680de to before e3ea71cb1408a013ed4e8a757b815f1a919324bdAffected
c31b70c9968fe9c4194d1b5d06d07596a3b680de to before 631aa4cb45099f09e9385dd786bd291c6270bfc4Affected
c31b70c9968fe9c4194d1b5d06d07596a3b680de to before 0f87720c7e4bcab07c24888b3cf12bfe857bb90eAffected
c31b70c9968fe9c4194d1b5d06d07596a3b680de to before fe99bbeee5c5dbd3abc30721a8079ced59649d97Affected

LinuxLinux

5.11Affected
before 5.11Not affected
5.15.222 through 5.15.*Not affected
6.1.189 through 6.1.*Not affected
6.6.158 through 6.6.*Not affected
6.12.112 through 6.12.*Not affected
6.18.55 through 6.18.*Not affected
7.2.9 through 7.2.*Not affected
7.3 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.