CVE-2026-98374 in Linux
Summary
by MITRE • 10/07/2026
In the Linux kernel, the following vulnerability has been resolved:
tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()
When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack. tp->retransmit_skb_hint keeps pointing at the freed skbuff_fclone_cache object.
The dangling hint is read in tcp_verify_retransmit_hint() and used as the root of the rbtree walk in tcp_xmit_retransmit_queue(). An unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with an attacker-supplied ICMP fragmentation-needed message, after which a simultaneous open frees the armed SYN skb:
BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) Read of size 4 at addr ffff88800604d928 by task swapper/1/0 Call Trace: tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) tcp_simple_retransmit (net/ipv4/tcp_input.c:3158) tcp_v4_err (net/ipv4/tcp_ipv4.c:587)
Sync the hint to the copy.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/07/2026
The Linux kernel contains a critical use-after-free vulnerability within the Transmission Control Protocol implementation, specifically affecting the handling of SYN packets during connection establishment and Fast Open operations. This flaw resides in the tcp_send_synack function, which is responsible for managing retransmission queues when sending synchronization segments to remote peers. The core technical issue arises from an inconsistency in pointer management when a cloned SYN socket buffer is replaced by a copy at the head of the retransmit queue. During this process, the original skbuff object is correctly unlinked and freed using tcp_rtx_queue_unlink_and_free. However, while the highest sequence acknowledgment pointer tp->highest_sack is properly repaired to reflect the new state, the tp->retransmit_skb_hint variable remains unchanged. This results in a dangling pointer that continues to reference memory within the slab_fclone_cache pool even after the original object has been deallocated and potentially reallocated for other purposes.
The operational impact of this vulnerability is severe because it allows an unprivileged attacker to trigger kernel code execution or cause a denial of service through a use-after-free condition. The dangling hint is subsequently accessed by tcp_verify_retransmit_hint, which serves as the starting point for walking the retransmission queue in rbtree structure via tcp_xmit_retransmit_queue. An attacker can exploit this by acting as a TCP Fast Open client and using sendmsg with MSG_FASTOPEN to arm the retransmit hint with an attacker-controlled ICMP fragmentation-needed message. When a simultaneous open occurs, the system frees the armed SYN socket buffer, leaving the kernel pointer invalid. Subsequent network events or internal processing that rely on tcp_mark_skb_lost will attempt to read from this freed memory address, leading to a KASAN slab-use-after-free error as documented in the call trace involving tcp_v4_err and tcp_simple_retransmit.
This vulnerability maps directly to CWE-416, which describes use after free errors where software continues to use pointers that point to freed memory. The exploitation vector aligns with ATT&CK techniques related to privilege escalation or denial of service through kernel-level memory corruption. By manipulating the retransmission queue state via ICMP messages and Fast Open mechanisms, an attacker can force the kernel into accessing invalid memory regions. This not only crashes the system but also poses a risk for arbitrary code execution if the freed slab cache is reused by other subsystems before the dangling pointer is dereferenced again. The lack of synchronization between the retransmit queue head update and the hint pointer creates a race condition window that can be reliably triggered under specific network conditions involving simultaneous opens and fragmentation issues.
To mitigate this vulnerability, it is essential to ensure that all pointers referencing socket buffers are synchronized when replacements occur in critical data structures. In this specific case, the fix involves updating tp->retransmit_skb_hint to point to the new copy of the SYN packet rather than leaving it pointing at the freed original object. This ensures consistency across all references within the TCP control block and prevents access to deallocated memory. System administrators should apply kernel updates that include this patch immediately. Additionally, network configurations can be hardened by restricting ICMP fragmentation-needed messages from untrusted sources if possible, although the primary defense remains applying the upstream Linux kernel fix. Regular vulnerability scanning and monitoring for KASAN reports in system logs are recommended to detect any potential exploitation attempts or residual instability caused by prior exposure to this flaw.