Cloudanix VulnDB

CVE-2026-98374

None

CVSS

—

EPSS

0.2%

Published

Oct 7, 2026

CISA due date

—

Cloudanix analysis

Next patch cycle SSVC: Track

A Linux kernel networking bug can cause crashes when handling certain connection setups, requiring an operating system update to prevent problems.

Exploitation
Remote Unauthenticated
Attacker needs
Low Privilege
Complexity
Moderate
Impact
Full Compromise
Component
OS kernel
Class
Use After Free
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Dangling retransmit_skb_hint pointer after tcp_rtx_queue_unlink_and_free of a cloned SYN skb in tcp_send_synack leaves a reference into freed skbuff_fclone_cache; subsequent reads in tcp_verify_retransmit_hint and tcp_xmit_retransmit_queue dereference the freed object.

Why it matters to the business

Risk of kernel crashes or memory corruption on Linux systems handling TCP simultaneous opens or TFO connections, potentially leading to denial of service; low likelihood of exploitation reduces immediate operational urgency.

How an attack unfolds

An unprivileged TFO client triggers the flaw by sending an attacker-controlled ICMP fragmentation-needed message to arm the hint, followed by a simultaneous open that frees the armed SYN skb, causing use-after-free when tcp_mark_skb_lost walks the retransmit queue.

How to fix it

Apply the upstream fix that synchronizes retransmit_skb_hint to the newly allocated copy of the SYN skb after tcp_rtx_queue_unlink_and_free in tcp_send_synack; rebuild and deploy updated kernel images across all affected distributions.

How to confirm the fix worked

Confirm the patch is present by inspecting tcp_send_synack for the added hint synchronization immediately after the unlink-and-free call; test with reproducer sequences involving TFO and ICMP errors while monitoring for KASAN reports.

Typical attack path

  1. Send crafted ICMP fragmentation-needed to arm retransmit_skb_hint via TFO sendmsg
  2. Initiate simultaneous TCP open to replace and free the SYN skb
  3. Trigger retransmit path (tcp_simple_retransmit or tcp_v4_err) to dereference the dangling hint
  4. Read freed memory in tcp_mark_skb_lost resulting in KASAN-detected slab-use-after-free

How to detect it

Search kernel logs and crash dumps for KASAN slab-use-after-free reports citing tcp_mark_skb_lost, tcp_simple_retransmit, or tcp_v4_err in conjunction with retransmit queue operations; correlate with TFO or simultaneous-open connection attempts.

What your security team should do

  • Prioritize kernel updates on all Linux hosts within the next maintenance window given the 16-day publication age
  • Disable unprivileged TCP Fast Open where not required to reduce attack surface
  • Enable KASAN or similar memory debugging in test environments to validate the fix
  • Review network error handling logs for anomalous ICMP fragmentation-needed traffic paired with TCP retransmits

The record

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack. tp->retransmit_skb_hint keeps pointing at the freed skbuff_fclone_cache object. The dangling hint is read in tcp_verify_retransmit_hint() and used as the root of the rbtree walk in tcp_xmit_retransmit_queue(). An unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with an attacker-supplied ICMP fragmentation-needed message, after which a simultaneous open frees the armed SYN skb: BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) Read of size 4 at addr ffff88800604d928 by task swapper/1/0 Call Trace: tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) tcp_simple_retransmit (net/ipv4/tcp_input.c:3158) tcp_v4_err (net/ipv4/tcp_ipv4.c:587) Sync the hint to the copy.

Affected packages

Ecosystem Package Introduced Fixed