CVE-2026-98374: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

CVE-2026-98374: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()

When tcp_send_synack() replaces the cloned SYN skb at the head of the
retransmit queue with a copy, it frees the original with
tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack.
tp->retransmit_skb_hint keeps pointing at the freed
skbuff_fclone_cache object.

The dangling hint is read in tcp_verify_retransmit_hint() and used as
the root of the rbtree walk in tcp_xmit_retransmit_queue().  An
unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with
an attacker-supplied ICMP fragmentation-needed message, after which a
simultaneous open frees the armed SYN skb:

  BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
  Read of size 4 at addr ffff88800604d928 by task swapper/1/0
  Call Trace:
   tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
   tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)
   tcp_v4_err (net/ipv4/tcp_ipv4.c:587)

Sync the hint to the copy.

The Linux kernel CVE team has assigned CVE-2026-98374 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 5.11 with commit c31b70c9968fe9c4194d1b5d06d07596a3b680de and fixed in 5.15.222 with commit fad6d429651e748365e93ca54645accc212f0018
	Issue introduced in 5.11 with commit c31b70c9968fe9c4194d1b5d06d07596a3b680de and fixed in 6.1.189 with commit c5b4da1f403a658c1c19766be2b426003ada419f
	Issue introduced in 5.11 with commit c31b70c9968fe9c4194d1b5d06d07596a3b680de and fixed in 6.6.158 with commit 71d45049b0d631dfdbf3c65305f7fca676de023b
	Issue introduced in 5.11 with commit c31b70c9968fe9c4194d1b5d06d07596a3b680de and fixed in 6.12.112 with commit e3ea71cb1408a013ed4e8a757b815f1a919324bd
	Issue introduced in 5.11 with commit c31b70c9968fe9c4194d1b5d06d07596a3b680de and fixed in 6.18.55 with commit 631aa4cb45099f09e9385dd786bd291c6270bfc4
	Issue introduced in 5.11 with commit c31b70c9968fe9c4194d1b5d06d07596a3b680de and fixed in 7.2.9 with commit 0f87720c7e4bcab07c24888b3cf12bfe857bb90e
	Issue introduced in 5.11 with commit c31b70c9968fe9c4194d1b5d06d07596a3b680de and fixed in 7.3-rc5 with commit fe99bbeee5c5dbd3abc30721a8079ced59649d97

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-98374
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/tcp_output.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/fad6d429651e748365e93ca54645accc212f0018
	https://git.kernel.org/stable/c/c5b4da1f403a658c1c19766be2b426003ada419f
	https://git.kernel.org/stable/c/71d45049b0d631dfdbf3c65305f7fca676de023b
	https://git.kernel.org/stable/c/e3ea71cb1408a013ed4e8a757b815f1a919324bd
	https://git.kernel.org/stable/c/631aa4cb45099f09e9385dd786bd291c6270bfc4
	https://git.kernel.org/stable/c/0f87720c7e4bcab07c24888b3cf12bfe857bb90e
	https://git.kernel.org/stable/c/fe99bbeee5c5dbd3abc30721a8079ced59649d97