CVE-2026-98374

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()<br /> <br /> When tcp_send_synack() replaces the cloned SYN skb at the head of the<br /> retransmit queue with a copy, it frees the original with<br /> tcp_rtx_queue_unlink_and_free() and only repairs tp-&gt;highest_sack.<br /> tp-&gt;retransmit_skb_hint keeps pointing at the freed<br /> skbuff_fclone_cache object.<br /> <br /> The dangling hint is read in tcp_verify_retransmit_hint() and used as<br /> the root of the rbtree walk in tcp_xmit_retransmit_queue(). An<br /> unprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with<br /> an attacker-supplied ICMP fragmentation-needed message, after which a<br /> simultaneous open frees the armed SYN skb:<br /> <br /> BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)<br /> Read of size 4 at addr ffff88800604d928 by task swapper/1/0<br /> Call Trace:<br /> tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)<br /> tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)<br /> tcp_v4_err (net/ipv4/tcp_ipv4.c:587)<br /> <br /> Sync the hint to the copy.