CVE-2026-90054 in Linux
Summary
by MITRE • 09/17/2026
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix corruption of urgent data on multi-segment retransmit
On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urg_ptr:
/* tcp_write_xmit() */ limit = mss_now; if (tso_segs > 1 && !tcp_urg_mode(tp)) limit = tcp_mss_split_point(...);
The retransmit path has no such guard. __tcp_retransmit_skb() builds a segs > 1 skb and hands it to the GSO layer, which only advances th->seq per segment and copies urg_ptr verbatim:
/* __tcp_retransmit_skb() */ len = cur_mss * segs; /* segs > 1, no urg_mode check */ ... /* tcp_gso_segment(): bumps seq only, urg_ptr is copied */
urg_ptr is an offset from the segment's own seq, so a copied value points at a different place on each segment. The receiver rebuilds the absolute urgent seq as seg.seq + urg_ptr, so it walks a moving urgent point instead of the one OOB byte:
seg1 seq 1 urg_ptr 5001 -> urgent @ 5001 (ok) seg2 seq 1001 urg_ptr 5001 -> urgent @ 6001 (wrong, +MSS) seg3 seq 2001 urg_ptr 5001 -> urgent @ 7001 (wrong, +2*MSS)
The real OOB byte is never pointed at, so the receiver stops splicing it out and delivers it as normal in-band data, corrupting the stream.
Guard the retransmit length like the xmit path: keep segs = 1 while in urgent mode.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2026
The Linux kernel TCP stack contains a critical logic flaw within its packet retransmission mechanism that leads to data corruption when handling Out-Of-Band (OOB) or urgent data during multi-segment transmission. This vulnerability arises from an inconsistency between the normal transmission path and the retransmission path regarding how TCP segments are constructed under specific conditions. Specifically, while the standard transmit function tcp_write_xmit correctly prevents the creation of Multi-Segment Transmission Segmentation Offload packets when in urgent mode by limiting segment counts to one, the retransmission logic implemented in __tcp_retransmit_skb lacks this protective guard. Consequently, during a retransmission event where multiple segments are involved and the connection is operating in urgent mode, the kernel erroneously constructs a single large socket buffer with more than one segment and passes it to the Generic Segmentation Offload layer without adjusting for the presence of an urgent pointer.
The technical root cause lies in how the TCP header fields are populated during segmentation. The urg_ptr field represents an offset relative to the sequence number of each individual segment, indicating where the OOB byte is located within that specific packet's payload. When __tcp_retransmit_skb creates a multi-segment buffer and hands it to tcp_gso_segment, the GSO layer correctly advances the TCP sequence header for each subsequent segment but copies the urg_ptr value verbatim from the original context. This results in the urgent pointer remaining static while the base sequence number increases by multiples of the Maximum Segment Size for each new segment. As a result, on the second segment, the calculated absolute position of the urgent byte becomes incorrect because it adds the same offset to a higher starting sequence number, and this error compounds linearly across subsequent segments in the burst.
The operational impact of this flaw is severe data stream corruption at the receiver end. The receiving TCP stack reconstructs the absolute location of the OOB byte by adding the segment's current sequence number to the received urg_ptr value. Due to the misalignment described above, the receiver calculates a moving target for the urgent byte rather than pointing to the actual single out-of-band data unit intended by the sender. Because the calculated position never matches the true location of the OOB byte, the receiver fails to identify and splice it out correctly from the main data stream. Instead, this critical control or signal data is delivered as standard in-band application payload, potentially causing protocol confusion, state machine errors, or functional failures in applications relying on TCP urgent mode for immediate notification mechanisms such as Telnet commands or SMTP signaling.
This vulnerability aligns with CWE-20 Improper Input Validation and CWE-841 Improper Enforcement of Mapping between Logical and Physical Objects, as the kernel fails to correctly map the logical urgency state to the physical segmentation logic during retransmission. From a threat modeling perspective using MITRE ATT&CK techniques, this could be leveraged in conjunction with other vulnerabilities for Denial of Service by disrupting application-level protocols that depend on TCP urgent data delivery integrity, effectively causing service degradation or unexpected behavior without requiring direct exploitation of memory corruption primitives. The issue highlights the complexity of maintaining state consistency across different code paths within high-performance network stacks where performance optimizations like TSO and GSO intersect with protocol-specific states like urgency.
To mitigate this vulnerability, system administrators must apply kernel updates that include the fix for tcp_write_xmit logic to also cover __tcp_retransmit_skb. The patch ensures that during retransmission, if the connection is in urgent mode, the segment count is forced to one, mirroring the behavior of the normal transmission path and preventing the construction of multi-segment buffers with static urgent pointers. Until patches are applied, operators should monitor for anomalies in applications using TCP urgent data delivery and consider disabling TSO or GSO on affected interfaces as a temporary workaround if performance impact is acceptable, though applying the kernel fix remains the definitive resolution to restore correct protocol behavior and prevent stream corruption.