CVE-2026-98255

A flaw was found in the Linux kernel. Its TCP (Transmission Control Protocol) fast-path processing logic fails to properly filter out-of-bounds acknowledgment (ACK) packets before validating them. A remote attacker could exploit this vulnerability by sending network packets with outdated ACK numbers, potentially altering connection states and causing connection disruption.

The TCP established fast path can accept a segment whose ACK is older than SND.UNA because the previous prediction condition rejects ACK values after SND.NXT but does not reject ACK values before SND.UNA. If the segment also carries the expected receive sequence number and payload, the payload can be processed and RCV.NXT can advance before the old ACK receives full validation in the slow path. This creates a network data injection and TCP state manipulation risk rather than a memory corruption issue. For the CVSS the PR:N is selected because no authenticated account or local execution context is required when an attacker can send forged TCP segments to the established connection. Attack complexity is high because an off path attacker normally needs the connection tuple and a valid receive sequence number, while an on path attacker or an attacker with suitable network visibility has a more practical trigger path. Impact includes modification of an established byte stream and possible connection desynchronization or disruption. No UAF, OOB access, information disclosure, or direct privilege escalation primitive is identified.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.