tcp SACK Overflow

Vulnerability analysis

During selective-acknowledgment processing, the TCP stack can coalesce enough retransmission data into one network buffer that its 16-bit segment count wraps. The resulting inconsistent accounting can trigger an internal assertion and crash the kernel. The fix prevents coalescing when either the representable payload or fragment count would exceed the counter’s limits, leaving oversized cases on the normal fallback path; the remaining consistency check is also made non-fatal. An unauthenticated remote attacker needs to participate in a SACK-enabled TCP connection and advertise the smallest accepted MSS, but needs no local privilege, physical access, or special hardware access.