CVE-2026-90054

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix corruption of urgent data on multi-segment retransmit

On the normal xmit path, while in urgent mode we refuse to build a

multi-segment TSO packet, so every segment gets its own urg_ptr:

/* tcp_write_xmit() */

limit = mss_now;

if (tso_segs > 1 && !tcp_urg_mode(tp))

limit = tcp_mss_split_point(...);

The retransmit path has no such guard. __tcp_retransmit_skb() builds a

segs > 1 skb and hands it to the GSO layer, which only advances th->seq

per segment and copies urg_ptr verbatim:

/* __tcp_retransmit_skb() */

len = cur_mss * segs; /* segs > 1, no urg_mode check */

...

/* tcp_gso_segment(): bumps seq only, urg_ptr is copied */

urg_ptr is an offset from the segment's own seq, so a copied value points

at a different place on each segment. The receiver rebuilds the absolute

urgent seq as seg.seq + urg_ptr, so it walks a moving urgent point instead

of the one OOB byte:

seg1 seq 1 urg_ptr 5001 ->

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References