VulnSocial

CVE-2026-98374

LOW

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack. tp->retransmit_skb_hint keeps pointing at the freed skbuff_fclone_cache object. The dangling hint is read in tcp_verify_retransmit_hint() and used as the root of the rbtree walk in tcp_xmit_retransmit_queue(). An unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with an attacker-supplied ICMP fragmentation-needed message, after which a simultaneous open frees the armed SYN skb: BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) Read of size 4 at addr ffff88800604d928 by task swapper/1/0 Call Trace: tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) tcp_simple_retransmit (net/ipv4/tcp_input.c:3158) tcp_v4_err (net/ipv4/tcp_ipv4.c:587) Sync the hint to the copy.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

NONE

Threat summary

  • 1 mentions across 1 observed day

What's happening

  • 1 total mentions across 1 day

Deep dive

Activity timeline1 mentions / 1d
00111Mentions · 2026-10-12: 110-12
Referenced assets1 URL
By indicator
Full discourse1 post
  • LinuxSecurity@lnxsec

    A kernel memory bug does not automatically mean a remote takeover. Treating every use-after-free as proven code execution makes Linux risk decisions worse, not better. CVE-2026-98374 concerns TCP Fast Open: a replaced SYN packet leaves a stale retransmission pointer, and a reported test triggers a four-byte read from freed memory. KASAN confirms the invalid read; the public record does not establish privilege escalation or exploitation of an arbitrary internet-facing server. The distinction matters when infrastructure teams must prioritize changes without overstating the evidence. In practical terms, it is a good time to: • Check your distribution's CVE-2026-98374 advisory for the exact release and kernel build. • Record `uname -r` and compare it with the installed kernel package. • Document the confirmed failure mode separately from hypothetical exploitation outcomes. How does your team keep vulnerability severity discussions grounded in demonstrated behavior? #LinuxSecurity #KernelSecurity #VulnerabilityManagement #SecurityOperations https://linuxsecurity.com/features/linux-tcp-fast-open-use-after-free

    0000086
    4.6K followersView on X

Explore more

Back to dashboard