CVE-2026-98374: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-98374 is a use-after-free vulnerability in the Linux kernel's TCP implementation, specifically in the tcp_send_synack() function. When this function replaces a cloned SYN skb at the head of the retransmit queue with a copy, it frees the original via tcp_rtx_queue_unlink_and_free() but leaves tp->retransmit_skb_hint pointing to the freed skbuff_fclone_cache object. The vulnerability affects Linux kernel versions from 5.11 onward, with fixes backported to stable branches including 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, and 7.2.9. It carries a CVSS v3.1 base score of 7.1 (High) (GitHub Advisory, Microsoft MSRC).

The root cause is a use-after-free (CWE-416) in the Linux kernel TCP stack. When tcp_send_synack() replaces the SYN skb, it only updates tp->highest_sack but neglects to update tp->retransmit_skb_hint, leaving a dangling pointer to freed memory. This dangling hint is subsequently dereferenced in tcp_verify_retransmit_hint() and used as the root of an rbtree walk in tcp_xmit_retransmit_queue(). An unprivileged local attacker can trigger this by using sendmsg(MSG_FASTOPEN) (TCP Fast Open) to arm the hint, then sending an attacker-crafted ICMP fragmentation-needed message; a simultaneous open then frees the armed SYN skb, resulting in a KASAN-detected slab-use-after-free read at tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316) (GitHub Advisory).

Successful exploitation allows an unprivileged local user to cause the kernel to read from freed memory, resulting in a system crash (kernel panic) and denial of service. The confidentiality impact is rated High due to potential exposure of freed kernel memory contents, and availability impact is High due to the system crash. Integrity is not directly affected. There is no evidence of lateral movement capability, but kernel memory disclosure could theoretically aid in further privilege escalation attempts (GitHub Advisory, Microsoft MSRC).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (GitHub Advisory). The EPSS score is approximately 0.161%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local unprivileged access and the ability to send MSG_FASTOPEN messages and craft ICMP fragmentation-needed packets, which limits the attack surface compared to remote vulnerabilities.

1. Gain local unprivileged access: Obtain a local user account on a vulnerable Linux system (kernel 5.11 through the unpatched versions of 5.15.x, 6.1.x, 6.6.x, 6.12.x, 6.18.x, or 7.2.x).
2. Enable TCP Fast Open: Ensure TCP Fast Open (TFO) is enabled on the target system (check /proc/sys/net/ipv4/tcp_fastopen).
3. Arm the retransmit_skb_hint: Use sendmsg() with the MSG_FASTOPEN flag to initiate a TFO connection, causing tp->retransmit_skb_hint to point to the SYN skb in the retransmit queue.
4. Inject ICMP fragmentation-needed: Send a crafted ICMP fragmentation-needed (type 3, code 4) message targeting the TFO connection to trigger tcp_simple_retransmit() and set the hint to the SYN skb.
5. Trigger simultaneous open: Initiate a simultaneous TCP open that causes tcp_send_synack() to free the original SYN skb via tcp_rtx_queue_unlink_and_free(), leaving tp->retransmit_skb_hint as a dangling pointer.
6. Trigger use-after-free: Cause the kernel to process retransmit queue operations (e.g., via another ICMP error), which dereferences the dangling pointer in tcp_verify_retransmit_hint() or tcp_xmit_retransmit_queue(), resulting in a kernel crash or memory disclosure (GitHub Advisory).

• Logs: Kernel logs (dmesg or /var/log/kern.log) showing BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost with a call trace including tcp_simple_retransmit and tcp_v4_err.
• Logs: Kernel panic or oops messages referencing net/ipv4/tcp_input.c:1316 or net/ipv4/tcp_ipv4.c:587.
• Network: Unusual ICMP type 3 (destination unreachable) / code 4 (fragmentation needed) packets directed at a host that has active TCP Fast Open connections.
• Process: Unexpected system crashes or reboots on systems with TCP Fast Open enabled, particularly correlated with active TFO client connections.

Apply the upstream Linux kernel patch that synchronizes tp->retransmit_skb_hint to the SYN skb copy in tcp_send_synack(). Fixed versions are available across stable branches: 5.15.222, 6.1.189, 6.6.158, 6.12.112, 6.18.55, 7.2.9, and 7.3-rc5 (GitHub Advisory). Microsoft has also released a patch for the Azure Linux 3 kernel (azl3_kernel_6.6.157.1-1) (Microsoft MSRC). As a temporary workaround where patching is not immediately feasible, disabling TCP Fast Open (echo 0 > /proc/sys/net/ipv4/tcp_fastopen) can eliminate the attack vector, though this may impact performance for TFO-dependent workloads.

The vulnerability was covered by Linux security outlets, including a dedicated article on LinuxSecurity.com focusing on the TCP Fast Open use-after-free issue (LinuxSecurity). It was also noted in the context of Microsoft's October 2026 Patch Tuesday, which addressed over 1,400 flaws (BleepingComputer). General community reaction has been measured, consistent with a kernel memory-safety fix without active exploitation.