CVE-2026-98374

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98374", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.345Z", "datePublished": "2026-10-07T13:01:48.600Z", "dateUpdated": "2026-10-24T14:08:34.914Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-24T14:08:34.914Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()\n\nWhen tcp_send_synack() replaces the cloned SYN skb at the head of the\nretransmit queue with a copy, it frees the original with\ntcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack.\ntp->retransmit_skb_hint keeps pointing at the freed\nskbuff_fclone_cache object.\n\nThe dangling hint is read in tcp_verify_retransmit_hint() and used as\nthe root of the rbtree walk in tcp_xmit_retransmit_queue(). An\nunprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with\nan attacker-supplied ICMP fragmentation-needed message, after which a\nsimultaneous open frees the armed SYN skb:\n\n BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n Read of size 4 at addr ffff88800604d928 by task swapper/1/0\n Call Trace:\n tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)\n tcp_v4_err (net/ipv4/tcp_ipv4.c:587)\n\nSync the hint to the copy."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "baseScore": 8.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:N - A malicious IPv4 peer supplies fragmentation-needed ICMP messages quoting the client's TFO SYN and an ACK-less crossed TCP SYN; ip_rcv() dispatches these through tcp_v4_err() and tcp_rcv_state_process() to the patched tcp_send_synack().\nAC:L - After the victim's TFO send, the peer controls packet ordering: ICMP makes tcp_simple_retransmit() cache and clone the SYN, then the crossed SYN makes tcp_send_synack() free it; a later PMTU event dereferences the stale hint without requiring a race or external failure.\nPR:N - The ordinary TCP and ICMP paths require only a matching tuple and quoted sequence, not authentication or target privileges; a peer that received the TFO SYN knows the values checked by tcp_v4_err() and the TCP socket lookup.\nUI:R - A victim-side process must issue sendmsg(MSG_FASTOPEN) with data and a usable cookie or no-cookie mode to establish tp->syn_data in TCP_SYN_SENT; remote packets alone cannot construct this vulnerable retransmit queue state.\nS:U - The freed skb, retransmit tree, and subsequent stale accesses all belong to the same host kernel TCP security authority; tcp_send_synack() does not cross a VM, IOMMU, or sandbox boundary.\nC:H - retransmit_skb_hint retains a freed skbuff_fclone_cache address, and tcp_verify_retransmit_hint() reads its TCP control block while tcp_xmit_retransmit_queue() follows its rbnode links, permitting attacker-influenced stale-object reads after slab reuse.\nI:H - tcp_xmit_retransmit_queue() can treat the reclaimed object as a live skb and pass it into retransmission code that modifies skb control and header state; attacker-shaped reuse of the stale rbnode and skb fields makes this UAF exploitable for kernel memory corruption.\nA:H - The demonstrated stale TCP_SKB_CB read already triggers KASAN in tcp_mark_skb_lost(), while using the freed object as an rbtree-walk root can dereference invalid links and cause a kernel oops or panic."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_output.c"], "versions": [{"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de", "lessThan": "fad6d429651e748365e93ca54645accc212f0018", "status": "affected", "versionType": "git"}, {"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de", "lessThan": "c5b4da1f403a658c1c19766be2b426003ada419f", "status": "affected", "versionType": "git"}, {"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de", "lessThan": "71d45049b0d631dfdbf3c65305f7fca676de023b", "status": "affected", "versionType": "git"}, {"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de", "lessThan": "e3ea71cb1408a013ed4e8a757b815f1a919324bd", "status": "affected", "versionType": "git"}, {"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de", "lessThan": "631aa4cb45099f09e9385dd786bd291c6270bfc4", "status": "affected", "versionType": "git"}, {"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de", "lessThan": "0f87720c7e4bcab07c24888b3cf12bfe857bb90e", "status": "affected", "versionType": "git"}, {"version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de", "lessThan": "fe99bbeee5c5dbd3abc30721a8079ced59649d97", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/ipv4/tcp_output.c"], "versions": [{"version": "5.11", "status": "affected"}, {"version": "0", "lessThan": "5.11", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.55", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.9", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "6.18.55"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.2.9"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.11", "versionEndExcluding": "7.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/fad6d429651e748365e93ca54645accc212f0018"}, {"url": "https://git.kernel.org/stable/c/c5b4da1f403a658c1c19766be2b426003ada419f"}, {"url": "https://git.kernel.org/stable/c/71d45049b0d631dfdbf3c65305f7fca676de023b"}, {"url": "https://git.kernel.org/stable/c/e3ea71cb1408a013ed4e8a757b815f1a919324bd"}, {"url": "https://git.kernel.org/stable/c/631aa4cb45099f09e9385dd786bd291c6270bfc4"}, {"url": "https://git.kernel.org/stable/c/0f87720c7e4bcab07c24888b3cf12bfe857bb90e"}, {"url": "https://git.kernel.org/stable/c/fe99bbeee5c5dbd3abc30721a8079ced59649d97"}], "title": "tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/ipv4/tcp_output.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "fad6d429651e748365e93ca54645accc212f0018", "status": "affected", "version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de", "versionType": "git"}, {"lessThan": "c5b4da1f403a658c1c19766be2b426003ada419f", "status": "affected", "version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de", "versionType": "git"}, {"lessThan": "71d45049b0d631dfdbf3c65305f7fca676de023b", "status": "affected", "version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de", "versionType": "git"}, {"lessThan": "e3ea71cb1408a013ed4e8a757b815f1a919324bd", "status": "affected", "version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de", "versionType": "git"}, {"lessThan": "631aa4cb45099f09e9385dd786bd291c6270bfc4", "status": "affected", "version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de", "versionType": "git"}, {"lessThan": "0f87720c7e4bcab07c24888b3cf12bfe857bb90e", "status": "affected", "version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de", "versionType": "git"}, {"lessThan": "fe99bbeee5c5dbd3abc30721a8079ced59649d97", "status": "affected", "version": "c31b70c9968fe9c4194d1b5d06d07596a3b680de", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/ipv4/tcp_output.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.11"}, {"lessThan": "5.11", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.55", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.9", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()\n\nWhen tcp_send_synack() replaces the cloned SYN skb at the head of the\nretransmit queue with a copy, it frees the original with\ntcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack.\ntp->retransmit_skb_hint keeps pointing at the freed\nskbuff_fclone_cache object.\n\nThe dangling hint is read in tcp_verify_retransmit_hint() and used as\nthe root of the rbtree walk in tcp_xmit_retransmit_queue(). An\nunprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with\nan attacker-supplied ICMP fragmentation-needed message, after which a\nsimultaneous open frees the armed SYN skb:\n\n BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n Read of size 4 at addr ffff88800604d928 by task swapper/1/0\n Call Trace:\n tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)\n tcp_v4_err (net/ipv4/tcp_ipv4.c:587)\n\nSync the hint to the copy."}], "id": "CVE-2026-98374", "lastModified": "2026-10-24T14:16:39.560", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-07T13:17:23.023", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/0f87720c7e4bcab07c24888b3cf12bfe857bb90e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/631aa4cb45099f09e9385dd786bd291c6270bfc4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/71d45049b0d631dfdbf3c65305f7fca676de023b"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c5b4da1f403a658c1c19766be2b426003ada419f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e3ea71cb1408a013ed4e8a757b815f1a919324bd"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fad6d429651e748365e93ca54645accc212f0018"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/fe99bbeee5c5dbd3abc30721a8079ced59649d97"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()", "id": "2547433", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2547433"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-825", "details": ["A flaw was found in the Linux kernel's TCP networking subsystem. When replacing packet buffers during connection establishment, the kernel frees memory without updating an internal retransmission pointer, resulting in a use-after-free vulnerability. An unprivileged local user can exploit this condition using TCP Fast Open (TFO) sockets and crafted network responses. Successful exploitation allows an attacker to crash the system, resulting in a Denial of Service (DoS) or unexpected kernel memory corruption."], "name": "CVE-2026-98374", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-07T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98374\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98374\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98374.mbox"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c31b70c9968fe9c4194d1b5d06d07596a3b680de,fad6d429651e748365e93ca54645accc212f0018)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c31b70c9968fe9c4194d1b5d06d07596a3b680de,c5b4da1f403a658c1c19766be2b426003ada419f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c31b70c9968fe9c4194d1b5d06d07596a3b680de,71d45049b0d631dfdbf3c65305f7fca676de023b)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c31b70c9968fe9c4194d1b5d06d07596a3b680de,e3ea71cb1408a013ed4e8a757b815f1a919324bd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c31b70c9968fe9c4194d1b5d06d07596a3b680de,631aa4cb45099f09e9385dd786bd291c6270bfc4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c31b70c9968fe9c4194d1b5d06d07596a3b680de,0f87720c7e4bcab07c24888b3cf12bfe857bb90e)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c31b70c9968fe9c4194d1b5d06d07596a3b680de,fe99bbeee5c5dbd3abc30721a8079ced59649d97)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "5.11"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,5.11)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.222,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.189,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.158,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.112,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.18.55,6.18.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.2.9,7.2.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.3-rc5,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-10-07T15:00:06.702085+00:00", "updated": "2026-10-24T15:45:07.135618+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}