CVE-2026-98374

Executive Summary

CVE-2026-98374 is a use-after-free vulnerability in the Linux kernel TCP stack, specifically in tcp_send_synack(), where tp->retransmit_skb_hint continues to point at a freed skbuff_fclone_cache object after the cloned SYN skb is replaced. An unprivileged TCP Fast Open (TFO) client can arm the dangling hint via an attacker-supplied ICMP fragmentation-needed message, and a simultaneous open event frees the armed SYN skb, producing a KASAN slab-use-after-free read. The impact is a kernel-level availability failure (panic/crash) with potential for further memory-corruption consequences depending on heap layout, affecting any system running an unpatched Linux kernel with TFO-enabled or reachable TCP service paths.

Technical Analysis

The flaw resides in the Linux kernel's TCP retransmission bookkeeping. When tcp_send_synack() replaces the cloned SYN skb at the head of the retransmit queue with a copy, the code calls tcp_rtx_queue_unlink_and_free() to release the original skb and repairs tp->highest_sack. However, tp->retransmit_skb_hint is not updated and therefore retains a pointer to the now-freed skbuff_fclone_cache object.

The dangling hint is subsequently read in tcp_verify_retransmit_hint() and used as the root of the rbtree walk in tcp_xmit_retransmit_queue(). Because the hint is consumed as the starting point for the retransmit search, any access after the associated object is freed constitutes a use-after-free read of kernel slab memory.

The trigger path is reachable by an unprivileged client using TCP Fast Open via sendmsg(MSG_FASTOPEN). This allows the attacker to arm the retransmit hint. The arming action is driven by an attacker-supplied ICMP fragmentation-needed message. Following arming, a simultaneous open condition causes the armed SYN skb to be freed. The resulting crash is reported as:

BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
Read of size 4 at addr ffff88800604d928 by task swapper/1/0
Call Trace:
 tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)
 tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)
 tcp_v4_err (net/ipv4/tcp_ipv4.c:587)

The call trace indicates that the stale pointer is dereferenced through the ICMP error handling path: tcp_v4_err() invokes tcp_simple_retransmit(), which calls tcp_mark_skb_lost(), which reads the freed memory. This is consistent with the mechanism where an ICMP fragmentation-needed message drives retransmission logic over a skb that has been freed. The root cause is a failure to synchronize tp->retransmit_skb_hint when the clone at the head of the retransmit queue is replaced and the original is freed. The described fix is to "Sync the hint to the copy."

No CVSS score, CWE classification, EPSS score, vendor advisory, or public PoC/exploit is provided in the intelligence data. No Nuclei template or exploit code is known. The vulnerability class is unambiguously memory-safety (use-after-free) in kernel networking.

Exploitation Scenarios

No public proof-of-concept or weaponized exploit is available for CVE-2026-98374. The following attack chain is inferred strictly from the vulnerability mechanism described in the NVD note and is presented at the vulnerability-class level. No specific implementation details beyond those in the description are asserted.

1. Reconnaissance / target identification. An attacker identifies a reachable Linux host exposing a TCP service, or more generally a host where the attacker can act as a TCP client toward the target's TCP stack, or can induce TCP interactions (including through ICMP responses). Because the mechanism involves an unprivileged TFO client and an attacker-supplied ICMP fragmentation-needed message, the relevant target is any network-reachable Linux system whose kernel implements the affected tcp_send_synack() behavior.

2. Triggering the flaw class. The attacker initiates TCP connection activity using TCP Fast Open (sendmsg(MSG_FASTOPEN)) to arm the retransmit hint. The NVD description states the dangling hint "can arm the hint with an attacker-supplied ICMP fragmentation-needed message." The attacker then drives the sequence such that a "simultaneous open frees the armed SYN skb." This combination produces the use-after-free when tcp_verify_retransmit_hint() and tcp_xmit_retransmit_queue() later consume the stale tp->retransmit_skb_hint.

3. Execution / memory access. The freed skbuff_fclone_cache object is read; the KASAN report shows a read of size 4 at the freed address, reached through tcp_v4_err() → tcp_simple_retransmit() → tcp_mark_skb_lost(). The behavior is a kernel memory-safety violation rather than a conventional remote code path; the immediate observable is a crash/bug splat under KASAN or equivalent instrumentation.

4. Post-exploitation impact. The demonstrated effect is a slab-use-after-free in kernel context, which can result in a kernel panic or denial of service on the affected host. As with any kernel use-after-free, there is a theoretical potential for further memory corruption or privilege escalation if the freed object is reallocated and controlled, contingent on heap grooming and kernel configuration. The provided data does not demonstrate privilege escalation, data exfiltration, or remote code execution, and no such capability should be assumed.

Note: No public PoC available; attack chain is inferred from vulnerability class and the NVD description.

Impact Assessment

The vulnerability is a kernel use-after-free in the TCP retransmission path. The primary demonstrable impact is availability: a KASAN-reported slab-use-after-free that can trigger a kernel bug/panic, resulting in denial of service against the affected host. The attack surface requires the ability to cause TCP Fast Open connection activity and to supply an ICMP fragmentation-needed message, effectively placing the attacker in a network position to influence the connection and its ICMP responses. Because the trigger involves an unprivileged client action, the barrier to initiating the sequence is low once network reachability and ICMP manipulation are possible.

Because no CVSS score is provided in the data, no numeric subscores can be cited. A notional severity consistent with the mechanism (use-after-free, network adjacency, availability impact) would emphasize Availability as the most clearly demonstrated impact. No CWE is assigned in the provided data, though the vulnerability class maps to CWE-416 (Use After Free). Blast radius includes any unpatched Linux system reachable over the network that processes the relevant TFO/ICMP sequence; because the flaw is in core TCP code (net/ipv4/), it is not confined to a single application.

Detection Guidance

Detection should focus on kernel-level indicators (KASAN splats, TCP bug reports, kernel panics) and on network-visible TFO plus ICMP error patterns. The rules below are provided as starting points for tuning; because no exploit signature is public, efficacy of network detection for this specific CVE is limited and should be validated in each environment.

Sigma Rule

title: Linux Kernel TCP Use-After-Free in tcp_send_synack (CVE-2026-98374)
id: 9f2c8a41-3d5b-5a7e-9c1a-0b6e7d4f2c11
status: experimental
description: Detects kernel log indicators of the KASAN slab-use-after-free referenced by CVE-2026-98374 in the TCP retransmit path.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-98374
author: valtersit.com
date: 2026/01/01
logsource:
  product: linux
  service: kernel
detection:
  selection_kasan:
    - 'KASAN: slab-use-after-free'
    - 'slab-use-after-free'
  selection_func:
    - 'tcp_mark_skb_lost'
    - 'tcp_simple_retransmit'
    - 'tcp_send_synack'
    - 'tcp_verify_retransmit_hint'
  condition: selection_kasan and selection_func
falsepositives:
  - Kernel development/testing with fault injection or memory stress tooling
level: high

YARA Rule

rule EXPL_CVE_2026_98374_Linux_TCP_UAF_Indicators
{
    meta:
        description = "Heuristic detection of strings associated with CVE-2026-98374 TCP use-after-free reports in kernel logs or captured crash dumps"
        author = "valtersit.com"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-98374"
        date = "2026-01-01"
        severity = "high"

    strings:
        $a = "KASAN: slab-use-after-free" ascii wide
        $b = "tcp_send_synack" ascii wide
        $c = "tcp_mark_skb_lost" ascii wide
        $d = "tcp_simple_retransmit" ascii wide
        $e = "tcp_verify_retransmit_hint" ascii wide
        $f = "tcp_xmit_retransmit_queue" ascii wide
        $g = "retransmit_skb_hint" ascii wide

    condition:
        $a and 1 of ($b, $c, $d, $e, $f, $g)
}

Suricata IDS Rule

alert tcp any any -> any any (msg:"CVE-2026-98374 Linux TCP TFO session with ICMP frag-needed may trigger retransmit hint UAF"; flow:established; tcp.flags:1; content:"|00 00|"; depth:0; threshold: type limit, track by_src, count 5, seconds 10; classtype:attempted-dos; reference:cve,2026-98374; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-98374; sid:202698374; rev:1;)

alert icmp any any -> any any (msg:"CVE-2026-98374 ICMP fragmentation-needed following TFO session (potential hint arming)"; itype:3; icode:4; threshold: type limit, track by_src, count 10, seconds 10; classtype:attempted-dos; reference:cve,2026-98374; reference:url,nvd.nist.gov/vuln/detail/CVE-2026-98374; sid:202698375; rev:1;)

Elastic Detection

sequence by host.id with maxspan=30s
  [network where network.transport == "tcp"] by source.ip, destination.ip
  [network where network.transport == "icmp" and icmp.type == 3 and icmp.code == 4]

Splunk SPL Query

index=os_linux sourcetype=syslog ("slab-use-after-free" OR "tcp_mark_skb_lost" OR "tcp_send_synack" OR "KASAN")
| stats count min(_time) as first_seen max(_time) as last_seen by host, source
| where count > 0
| eval first_seen=strftime(first_seen, "%Y-%m-%d %H:%M:%S"), last_seen=strftime(last_seen, "%Y-%m-%d %H:%M:%S")
| sort - count

Wazuh OSSEC Rule

<group name="linux,kernel,cve-2026-98374,">
  <rule id="202698374" level="12">
    <decoded_as>syslog</decoded_as>
    <match>slab-use-after-free|tcp_mark_skb_lost|tcp_send_synack|tcp_simple_retransmit|tcp_verify_retransmit_hint</match>
    <description>CVE-2026-98374: possible Linux kernel TCP use-after-free (retransmit_skb_hint) detected in kernel log</description>
    <mitre>
      <id>T1190</id>
    </mitre>
    <group>kernel_memory_corruption,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 (UNPATCHED — no patch evidence from any tracked source).

1. Immediate mitigations

• Reduce exposure to the trigger surface where operationally feasible: restrict or disable TCP Fast Open on systems that do not require it, since the attack sequence requires an unprivileged TFO client action (sendmsg(MSG_FASTOPEN)).
• Enforce ICMP filtering/rate-limiting on boundary devices to make attacker-supplied ICMP fragmentation-needed messages harder to deliver to affected hosts.
• Segment and firewall hosts so that untrusted clients cannot establish the TCP interaction pattern required to arm and free the SYN skb. Restrict who can initiate connections into sensitive Linux-based infrastructure.
• Monitor kernel logs for KASAN/UAF splats referencing the functions listed above; treat these as availability-affecting incidents.

2. Patch / upgrade steps

• No vendor fix or workaround is identified in the provided data. Track the upstream Linux kernel stable and mainline trees for a commit that addresses tcp_send_synack() by synchronizing tp->retransmit_skb_hint when the cloned SYN skb is replaced (described as "Sync the hint to the copy").
• Apply the distribution kernel update as soon as the backported fix is available for the running kernel series; verify the fix by checking the kernel changelog/service entry for the relevant CVE.
• Reboot into the patched kernel and confirm the running version post-upgrade.

3. Long-term hardening

• Enable Kernel Address Sanitizer (KASAN) on test/CI kernels to catch use-after-free regressions in networking code prior to production exposure.
• Maintain disciplined kernel patch cadence and subscribe to the kernel stable and linux-distros security lists to minimize the window between public fix and deployment.
• Minimize unnecessary network-facing TCP services and apply least-privilege network segmentation to limit reachability of kernel networking attack surfaces.
• Deploy canary/monitoring hosts with TFO enabled in lab environments to regression-test kernel updates against the described trigger sequence.

References

• NVD — CVE-2026-98374: https://nvd.nist.gov/vuln/detail/CVE-2026-98374
• Linux kernel source, networking TCP implementation: net/ipv4/tcp_input.c, net/ipv4/tcp_ipv4.c (function references per NVD description)
• CWE-416: Use After Free — https://cwe.mitre.org/data/definitions/416.html
• MITRE ATT&CK T1190 — Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/
• CISA Known Exploited Vulnerabilities catalog: not applicable — CISA KEV status is NO for this CVE

No threat actor campaigns or exploit-in-the-wild evidence are identified in the provided data. No public PoC, exploit code, or Nuclei template is known. EPSS has not yet been scored by FIRST.org for this CVE.