HIGH Introduced in 5.11
tcp SynackHint UAF
CVE-2026-98374
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
KernelScan AI6.9MEDIUM
01Description
In the Linux kernel, the following vulnerability has been resolved: tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack() When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, it frees the original with tcp_rtx_queue_unlink_and_free() and only repairs tp->highest_sack. tp->retransmit_skb_hint keeps pointing at the freed skbuff_fclone_cache object. The dangling hint is read in tcp_verify_retransmit_hint() and used as the root of the rbtree walk in tcp_xmit_retransmit_queue(). An unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with an attacker-supplied ICMP fragmentation-needed message, after which a simultaneous open frees the armed SYN skb: BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) Read of size 4 at addr ffff88800604d928 by task swapper/1/0 Call Trace: tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) tcp_simple_retransmit (net/ipv4/tcp_input.c:3158) tcp_v4_err (net/ipv4/tcp_ipv4.c:587) Sync the hint to the copy.
02KernelScan AI Analysis
Risk summary
An unprivileged local user can trigger a use-after-free in the TCP retransmit queue via TCP Fast Open, leading to potential kernel memory corruption and privilege escalation. The vulnerability requires network-supplied ICMP and SYN packets to arm and trigger the dangling pointer, making network-exposed systems more susceptible. Successful exploitation could enable arbitrary code execution in kernel context.
Vulnerability analysis
A cleanup path in the TCP retransmit queue can free a queued packet while an internal tracking pointer still references it. When a simultaneous-open SYN-ACK replaces the head of the retransmit queue, the original packet is freed but the retransmit hint is left dangling; any later operation that walks the retransmit tree through that hint reads freed memory. The fix updates the hint to point at the replacement packet, matching the repair already applied to another tracking pointer. The bug is reachable from an unprivileged local process using TCP Fast Open, with network-supplied ICMP and SYN packets used to arm and trigger the dangling reference; network-exposed hosts and multi-tenant environments are most at risk.
Lifecycle
03Fix Versions
| Branch | Introduced | Fixed in | Patch commit |
|---|---|---|---|
| 5.15 | 5.11 | 5.15.222 | fad6d429651e |
| 6.1 | 5.11 | 6.1.189 | c5b4da1f403a |
| 6.12 | 5.11 | 6.12.112 | e3ea71cb1408 |
| 6.18 | 5.11 | 6.18.55 | 631aa4cb4509 |
| 6.6 | 5.11 | 6.6.158 | 71d45049b0d6 |
| 7.2 | 5.11 | 7.2.9 | 0f87720c7e4b |
| mainline | 5.11 | 7.3 | fe99bbeee5c5 |
| cip/6.1 | 5.11 | 6.1.189-cip61 | c5b4da1f403a |
| cip/6.1-rt | 5.11 | 6.1.189-cip61-rt32 | c5b4da1f403a |
| cip/6.12 | 5.11 | 6.12.112-cip33 | e3ea71cb1408 |
04CIP Kernels
State of the newest release of each Civil Infrastructure Platform SLTS tree, from CIP's own fix records.
| CIP tree | State |
|---|---|
| cip/6.12 | Fixed in 6.12.112-cip33 |
| cip/6.1 | Fixed in 6.1.189-cip61 |
| cip/6.1-rt | Fixed in 6.1.189-cip61-rt32 |