CVE-2026-98255

What it actually does

The TCP fast path accepted ACK segments with sequence numbers before SND.UNA or after SND.NXT without validation, allowing such segments (and any payload they carried) to modify connection state such as advancing RCV.NXT before RFC 5961 checks and challenge-ACK logic in tcp_ack() could run.

Why it matters to the business

Attackers could corrupt TCP connection state on affected Linux systems, potentially leading to session disruption, data injection, or denial of service on network-facing services; with low EPSS and no KEV listing the immediate operational risk remains limited.

How an attack unfolds

An attacker establishes or hijacks a TCP connection and sends segments containing an excessively old ACK number (before SND.UNA) together with payload data; because the fast-path logic previously skipped proper validation, the segment could be accepted and advance RCV.NXT before the slow-path checks rejected it.

How to fix it

Apply the upstream Linux kernel patch that excludes old ACKs from the fast path so they are always validated by tcp_ack() according to RFC 5961; rebuild and deploy updated kernels on all affected systems; monitor vendor backports for distribution-specific packages.

How to confirm the fix worked

Confirm the fix is present by inspecting the tcp_input.c (or equivalent) source for the added checks that route ACKs outside the [SND.UNA, SND.NXT] window to the slow path; test with crafted packets containing old ACK numbers to ensure they no longer advance RCV.NXT without proper validation.

Typical attack path

1. Attacker obtains a position to send TCP segments to the victim (e.g., on-path or via connection hijacking).
2. Attacker crafts a segment whose ACK field is older than SND.UNA or newer than SND.NXT and may include attacker-controlled payload.
3. The segment is processed on the TCP fast path, bypassing RFC 5961 validation.
4. Connection state (RCV.NXT) is advanced or other side-effects occur before slow-path rejection.
5. Attacker observes or exploits the resulting state corruption for further attack steps.

How to detect it

Examine kernel logs, netfilter or tcpdump captures, and any custom TCP instrumentation for segments whose ACK field falls outside the expected window; look for unexpected RCV.NXT advances followed by RST or challenge ACKs.

What your security team should do

• Prioritize kernel updates on internet-facing systems once distribution packages are released.
• Review network segmentation and firewall rules to limit exposure of TCP services.
• Enable logging of unusual TCP ACK anomalies if kernel instrumentation permits.
• Track EPSS and KEV updates for any change in exploit maturity.