CVE-2026-98374

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

When tcp_send_synack() replaces the cloned SYN skb at the head of the

retransmit queue with a copy, it frees the original with

tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack.

tp->retransmit_skb_hint keeps pointing at the freed

skbuff_fclone_cache object.

The dangling hint is read in tcp_verify_retransmit_hint() and used as

the root of the rbtree walk in tcp_xmit_retransmit_queue(). An

unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with

an attacker-supplied ICMP fragmentation-needed message, after which a

simultaneous open frees the armed SYN skb:

BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)

Read of size 4 at addr ffff88800604d928 by task swapper/1/0

Call Trace:

tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)

tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)

tcp_v

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References