Linux Kernel: Use-after-free in TCP SYN-ACK handling
Summary
The Linux kernel TCP stack contains a use-after-free in tcp_send_synack(). A stale retransmit hint still points to a freed SYN packet buffer and can be used during retransmission, which can cause a kernel crash or memory corruption. According to the description, an unprivileged TCP Fast Open client can trigger the flaw over the network using a crafted ICMP fragmentation-needed message and a simultaneous open. The CVSS score is 8.8, but the NVD status was still Received when the research was done.
Affected
- Linux kernel from 5.11 up to the fixed stable versions listed below
- Stable branches before their fixes: 5.15, 6.1, 6.6, 6.12, 6.18 and 7.2
- Versions 7.3 and later: the CNA record is ambiguous; verify with upstream
- Distribution kernels: depends on the vendor patch level; check the affected Debian versions on OSV
Fixed in
- Upstream stable kernels 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55 and 7.2.9 or later
- Fix commits include 0f87720c7e4bcab07c24888b3cf12bfe857bb90e and others listed in the sources
- Fixed distribution package versions: Unknown.
Workaround
- Disable TCP Fast Open with sysctl net.ipv4.tcp_fastopen = 0 (stopgap only, does not fix the kernel)
- No livepatch coverage confirmed
Exploitation
- No evidence of exploitation in the wild found
- No public proof of concept found
- Not found in CISA KEV in the searches performed
- EPSS 0.00293 (low)
Our recommendation
- Install the kernel update from your distribution in the regular update cycle and reboot afterwards
- Prioritise hosts with TCP Fast Open enabled and internet-facing systems
- Check whether net.ipv4.tcp_fastopen is enabled and disable it where it is not required
- Do not confuse this with CVE-2026-98432, which is a separate issue
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Linux stable kernel fix commit 0f87720c7e4bcab07c24888b3cf12bfe857bb90e git.kernel.org
- Linux stable kernel fix commit fad6d429651e748365e93ca54645accc212f0018 git.kernel.org
- OSV: CVE-2026-98374 osv.dev
- OSV: DEBIAN-CVE-2026-98374 osv.dev
- SentinelOne vulnerability database: CVE-2026-98374 www.sentinelone.com
- Linux TCP Fast Open use-after-free analysis linuxsecurity.com
- SUSE CVE summary via Vulners vulners.com
- OpenCVE: CVE-2026-98374 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 21:24.
Original description (NVD)
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack. tp->retransmit_skb_hint keeps pointing at the freed skbuff_fclone_cache object. The dangling hint is read in tcp_verify_retransmit_hint() and used as the root of the rbtree walk in tcp_xmit_retransmit_queue(). An unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with an attacker-supplied ICMP fragmentation-needed message, after which a simultaneous open frees the armed SYN skb: BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) Read of size 4 at addr ffff88800604d928 by task swapper/1/0 Call Trace: tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) tcp_simple_retransmit (net/ipv4/tcp_input.c:3158) tcp_v4_err (net/ipv4/tcp_ipv4.c:587) Sync the hint to the copy.
NVD references (7)
- https://git.kernel.org/stable/c/0f87720c7e4bcab07c24888b3cf12bfe857bb90e
- https://git.kernel.org/stable/c/631aa4cb45099f09e9385dd786bd291c6270bfc4
- https://git.kernel.org/stable/c/71d45049b0d631dfdbf3c65305f7fca676de023b
- https://git.kernel.org/stable/c/c5b4da1f403a658c1c19766be2b426003ada419f
- https://git.kernel.org/stable/c/e3ea71cb1408a013ed4e8a757b815f1a919324bd
- https://git.kernel.org/stable/c/fad6d429651e748365e93ca54645accc212f0018
- https://git.kernel.org/stable/c/fe99bbeee5c5dbd3abc30721a8079ced59649d97
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.