CVE-2026-98374

A flaw was found in the Linux kernel's TCP networking subsystem. When replacing packet buffers during connection establishment, the kernel frees memory without updating an internal retransmission pointer, resulting in a use-after-free vulnerability. An unprivileged local user can exploit this condition using TCP Fast Open (TFO) sockets and crafted network responses. Successful exploitation allows an attacker to crash the system, resulting in a Denial of Service (DoS) or unexpected kernel memory corruption.

This vulnerability is rated as Moderate impact for Red Hat Enterprise Linux because exploitation requires a local unprivileged attacker to orchestrate specific TCP Fast Open handshakes alongside incoming network feedback. Systems running kernels with the affected TCP retransmission logic, such as RHEL 9 and RHEL 10, may encounter memory corruption leading to a kernel crash. Because triggering the condition demands local socket access and synchronized networking states rather than unauthenticated remote exploitation, the risk remains bounded to local denial of service or privilege boundaries.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.