Linux Kernel CVE-2026-98374

Requires the host to use TCP Fast Open: an unprivileged LOCAL process must initiate a TFO connection via sendmsg(MSG_FASTOPEN). The attacker must then deliver a crafted ICMP 'fragmentation needed' message to arm tp->retransmit_skb_hint, and a simultaneous TCP open must free the cloned SYN skb at the head of the retransmit queue while the hint still points at it - the freed skbuff_fclone_cache object is then read during tcp_xmit_retransmit_queue's rbtree walk. Limiting factors: TFO must be in use, the attacker must win the simultaneous-open race and land the ICMP at the right moment, and only kernels in the affected commit range (pre-fix 5.15.x/6.1.x/6.6.x/6.12.x/6.18.x/7.2.x and the 5.11+ line) are vulnerable. Only the demonstrated impact (a UAF read causing a kernel crash) is confirmed by the available sources.

Signals point to a moderate, not emergency, priority. The input CVSS of 8.8 (AV:N/AC:L/PR:N/UI:R) implies a remote, unauthenticated, low-complexity flaw, but the upstream description tells a different story: the trigger is an UNPRIVILEGED LOCAL TFO client calling sendmsg(MSG_FASTOPEN), combined with an attacker-supplied ICMP 'fragmentation needed' message and a race on simultaneous TCP open. CVSS indicates a pure network vector with no privileges, but the description implies a local unprivileged process must participate and that a timing race (simultaneous open) is required - verify reachability with the specific deployment before trusting AV:N/AC:L. The decision label is 'this_week' (not act_now/emergency), consistent with the supporting signals: EPSS is low at 0.16% (5th percentile), there is no CISA KEV listing, and no public exploit is referenced - only the upstream fix commits. The demonstrated impact is a KASAN slab-use-after-free READ used as the root of an rbtree walk (tcp_mark_skb_lost → tcp_simple_retransmit → tcp_v4_err), i.e. a kernel crash / denial-of-service with possible information disclosure, rather than a proven code-execution primitive. Net: a legitimate kernel memory-safety bug worth patching on a normal stable-update cadence, but the 8.8 score likely overstates real-world attacker reach given the local-client and race prerequisites.

An unprivileged local process on the host opens a TCP Fast Open connection via sendmsg(MSG_FASTOPEN); an attacker then delivers a crafted ICMP fragmentation-needed message that arms tp->retransmit_skb_hint, and a simultaneous open frees the cloned SYN skb that the hint still references. The subsequent retransmit-queue walk dereferences the freed skbuff_fclone_cache object, producing a use-after-free read that crashes the kernel (KASAN-detected) and may leak kernel memory. No public exploit is referenced - only the upstream fix commits - and success depends on winning the simultaneous-open race and ICMP timing.