From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 2E58447F793 for ; Wed, 7 Oct 2026 13:03:22 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791378213; cv=none; b=oGURaCPGPwYwe2dPNx58vE5ydAOC3fvEbpEv6L83BIxs1roehsIU8c5OTen0iQlBZHvnUaCb7ny7U11tCsgxCGwnyeqPWE93GVJDXlXp+aLtLs+FNiL2zUQE9FHicaIVuMC6Heh3ywV4qhOLmECJSvPTimHGxb7SZJn+NYQd70M= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1791378213; c=relaxed/simple; bh=fdwnVtBMQJDfO2f6f/EPeq0Sxe06o0LD8OQ3DGTgqAA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=iNAs1HoOHHEKoxrQGu/BaFrv1EvRbMcDwJNF7hyJtqe8t1Z8DraInV5vKKbwok7N1zsW9cR8a6rVExu38DKqwBuOxkx2vPyTW8BYoNg0bSCNRk6XjSsX39QpgyUK4qZdzakWBSAffMQwQNd/YaxGPpYArso74tDsU2cQoJD0ed4= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=TTe2oV78; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="TTe2oV78" Received: by smtp.kernel.org (Postfix) with ESMTPSA id C1AB51F0089C; Wed, 7 Oct 2026 13:03:21 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1791378202; bh=SiTLjpfBs2aF1QELPG3i5qkLxYLF2aawxLUkw+C7Eb8=; h=From:To:Cc:Subject:Date:Reply-To; b=TTe2oV781ZfiaR/RfOZhU0pgD/6B+NVvtaB80oNgBvBiIPX45gFXHQomw9LkUZ74d zGVCOyjA+YBFgmONc+9Gcfuayj1iEt7Yg2vBgj8ai0Jw1sF5hLP0XarSCfUNNdqVvQ W4LOPJQBfkNJ/LHBZAr2eTXrZQx49ZBG96CbKqNs= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-98374: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() Date: Wed, 7 Oct 2026 15:01:51 +0200 Message-ID: <2026100751-CVE-2026-98374-35fe@gregkh> X-Mailer: git-send-email 2.56.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=3861; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=suH8nKKPrf4voszrtMHgJ3YDyuw7zaPZHKA/gAT6s+Y=; b=owGbwMvMwCRo6H6F97bub03G02pJDFnHnPbvrfcykjt16VThGs3XDkmrbJ7IaR9nYz3o8DDM2 5ot4qJsRywLgyATg6yYIsuXbTxH91ccUvQytD0NM4eVCWQIAxenAEzELJBhfvnPcEWOhgPyC25t /3CJpYBZXtE9imHBUSfRLTdLDmrblq2blCIg6bSY7XAiAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack. tp->retransmit_skb_hint keeps pointing at the freed skbuff_fclone_cache object. The dangling hint is read in tcp_verify_retransmit_hint() and used as the root of the rbtree walk in tcp_xmit_retransmit_queue(). An unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with an attacker-supplied ICMP fragmentation-needed message, after which a simultaneous open frees the armed SYN skb: BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) Read of size 4 at addr ffff88800604d928 by task swapper/1/0 Call Trace: tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) tcp_simple_retransmit (net/ipv4/tcp_input.c:3158) tcp_v4_err (net/ipv4/tcp_ipv4.c:587) Sync the hint to the copy. The Linux kernel CVE team has assigned CVE-2026-98374 to this issue. Affected and fixed versions =========================== Issue introduced in 5.11 with commit c31b70c9968fe9c4194d1b5d06d07596a3b680de and fixed in 5.15.222 with commit fad6d429651e748365e93ca54645accc212f0018 Issue introduced in 5.11 with commit c31b70c9968fe9c4194d1b5d06d07596a3b680de and fixed in 6.1.189 with commit c5b4da1f403a658c1c19766be2b426003ada419f Issue introduced in 5.11 with commit c31b70c9968fe9c4194d1b5d06d07596a3b680de and fixed in 6.6.158 with commit 71d45049b0d631dfdbf3c65305f7fca676de023b Issue introduced in 5.11 with commit c31b70c9968fe9c4194d1b5d06d07596a3b680de and fixed in 6.12.112 with commit e3ea71cb1408a013ed4e8a757b815f1a919324bd Issue introduced in 5.11 with commit c31b70c9968fe9c4194d1b5d06d07596a3b680de and fixed in 6.18.55 with commit 631aa4cb45099f09e9385dd786bd291c6270bfc4 Issue introduced in 5.11 with commit c31b70c9968fe9c4194d1b5d06d07596a3b680de and fixed in 7.2.9 with commit 0f87720c7e4bcab07c24888b3cf12bfe857bb90e Issue introduced in 5.11 with commit c31b70c9968fe9c4194d1b5d06d07596a3b680de and fixed in 7.3-rc5 with commit fe99bbeee5c5dbd3abc30721a8079ced59649d97 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-98374 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/ipv4/tcp_output.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/fad6d429651e748365e93ca54645accc212f0018 https://git.kernel.org/stable/c/c5b4da1f403a658c1c19766be2b426003ada419f https://git.kernel.org/stable/c/71d45049b0d631dfdbf3c65305f7fca676de023b https://git.kernel.org/stable/c/e3ea71cb1408a013ed4e8a757b815f1a919324bd https://git.kernel.org/stable/c/631aa4cb45099f09e9385dd786bd291c6270bfc4 https://git.kernel.org/stable/c/0f87720c7e4bcab07c24888b3cf12bfe857bb90e https://git.kernel.org/stable/c/fe99bbeee5c5dbd3abc30721a8079ced59649d97