GHSA-2Q84-VC4J-MP23
Vulnerability from github – Published: 2026-10-07 15:31 – Updated: 2026-10-07 15:31In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack. tp->retransmit_skb_hint keeps pointing at the freed skbuff_fclone_cache object.
The dangling hint is read in tcp_verify_retransmit_hint() and used as the root of the rbtree walk in tcp_xmit_retransmit_queue(). An unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with an attacker-supplied ICMP fragmentation-needed message, after which a simultaneous open frees the armed SYN skb:
BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) Read of size 4 at addr ffff88800604d928 by task swapper/1/0 Call Trace: tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) tcp_simple_retransmit (net/ipv4/tcp_input.c:3158) tcp_v4_err (net/ipv4/tcp_ipv4.c:587)
Sync the hint to the copy.
{
"affected": [],
"aliases": [
"CVE-2026-98374"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-10-07T13:17:23Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()\n\nWhen tcp_send_synack() replaces the cloned SYN skb at the head of the\nretransmit queue with a copy, it frees the original with\ntcp_rtx_queue_unlink_and_free() and only repairs tp-\u003ehighest_sack.\ntp-\u003eretransmit_skb_hint keeps pointing at the freed\nskbuff_fclone_cache object.\n\nThe dangling hint is read in tcp_verify_retransmit_hint() and used as\nthe root of the rbtree walk in tcp_xmit_retransmit_queue(). An\nunprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with\nan attacker-supplied ICMP fragmentation-needed message, after which a\nsimultaneous open frees the armed SYN skb:\n\n BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n Read of size 4 at addr ffff88800604d928 by task swapper/1/0\n Call Trace:\n tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)\n tcp_v4_err (net/ipv4/tcp_ipv4.c:587)\n\nSync the hint to the copy.",
"id": "GHSA-2q84-vc4j-mp23",
"modified": "2026-10-07T15:31:59Z",
"published": "2026-10-07T15:31:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-98374"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/0f87720c7e4bcab07c24888b3cf12bfe857bb90e"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/631aa4cb45099f09e9385dd786bd291c6270bfc4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/71d45049b0d631dfdbf3c65305f7fca676de023b"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/c5b4da1f403a658c1c19766be2b426003ada419f"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/e3ea71cb1408a013ed4e8a757b815f1a919324bd"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fad6d429651e748365e93ca54645accc212f0018"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/fe99bbeee5c5dbd3abc30721a8079ced59649d97"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.