FKIE_CVE-2026-90054

Vulnerability from fkie_nvd - Published: 2026-09-17 17:16 - Updated: 2026-10-19 09:18
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urg_ptr: /* tcp_write_xmit() */ limit = mss_now; if (tso_segs > 1 && !tcp_urg_mode(tp)) limit = tcp_mss_split_point(...); The retransmit path has no such guard. __tcp_retransmit_skb() builds a segs > 1 skb and hands it to the GSO layer, which only advances th->seq per segment and copies urg_ptr verbatim: /* __tcp_retransmit_skb() */ len = cur_mss * segs; /* segs > 1, no urg_mode check */ ... /* tcp_gso_segment(): bumps seq only, urg_ptr is copied */ urg_ptr is an offset from the segment's own seq, so a copied value points at a different place on each segment. The receiver rebuilds the absolute urgent seq as seg.seq + urg_ptr, so it walks a moving urgent point instead of the one OOB byte: seg1 seq 1 urg_ptr 5001 -> urgent @ 5001 (ok) seg2 seq 1001 urg_ptr 5001 -> urgent @ 6001 (wrong, +MSS) seg3 seq 2001 urg_ptr 5001 -> urgent @ 7001 (wrong, +2*MSS) The real OOB byte is never pointed at, so the receiver stops splicing it out and delivers it as normal in-band data, corrupting the stream. Guard the retransmit length like the xmit path: keep segs = 1 while in urgent mode.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/3d4e005c198dc410ad568f832bffa7569c059ff8
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/47eb90299e6882d6445672530dd7c51ac33ebdbd
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/4fd2ee4ac154c204d95d8db72221446dac5af9b8
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/711bfd762bec05fb19bc3b17cbb157c39f4e66da
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/8eb51013b6308870479a64b4a2a018697b997849
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b8f08a94b2a4addc39249dcf9c792e786108621b
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ce2b807f42ed5e55567b8864ab72963f90779270
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/ebe55406404f3cb28e36d2b668e2c6c05026ec29
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "8eb51013b6308870479a64b4a2a018697b997849",
              "status": "affected",
              "version": "10d3be569243def8d92ac3722395ef5a59c504e6",
              "versionType": "git"
            },
            {
              "lessThan": "711bfd762bec05fb19bc3b17cbb157c39f4e66da",
              "status": "affected",
              "version": "10d3be569243def8d92ac3722395ef5a59c504e6",
              "versionType": "git"
            },
            {
              "lessThan": "3d4e005c198dc410ad568f832bffa7569c059ff8",
              "status": "affected",
              "version": "10d3be569243def8d92ac3722395ef5a59c504e6",
              "versionType": "git"
            },
            {
              "lessThan": "4fd2ee4ac154c204d95d8db72221446dac5af9b8",
              "status": "affected",
              "version": "10d3be569243def8d92ac3722395ef5a59c504e6",
              "versionType": "git"
            },
            {
              "lessThan": "ebe55406404f3cb28e36d2b668e2c6c05026ec29",
              "status": "affected",
              "version": "10d3be569243def8d92ac3722395ef5a59c504e6",
              "versionType": "git"
            },
            {
              "lessThan": "b8f08a94b2a4addc39249dcf9c792e786108621b",
              "status": "affected",
              "version": "10d3be569243def8d92ac3722395ef5a59c504e6",
              "versionType": "git"
            },
            {
              "lessThan": "47eb90299e6882d6445672530dd7c51ac33ebdbd",
              "status": "affected",
              "version": "10d3be569243def8d92ac3722395ef5a59c504e6",
              "versionType": "git"
            },
            {
              "lessThan": "ce2b807f42ed5e55567b8864ab72963f90779270",
              "status": "affected",
              "version": "10d3be569243def8d92ac3722395ef5a59c504e6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/ipv4/tcp_output.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.7"
            },
            {
              "lessThan": "4.7",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.52",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.6",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix corruption of urgent data on multi-segment retransmit\n\nOn the normal xmit path, while in urgent mode we refuse to build a\nmulti-segment TSO packet, so every segment gets its own urg_ptr:\n\n\t/* tcp_write_xmit() */\n\tlimit = mss_now;\n\tif (tso_segs \u003e 1 \u0026\u0026 !tcp_urg_mode(tp))\n\t\tlimit = tcp_mss_split_point(...);\n\nThe retransmit path has no such guard. __tcp_retransmit_skb() builds a\nsegs \u003e 1 skb and hands it to the GSO layer, which only advances th-\u003eseq\nper segment and copies urg_ptr verbatim:\n\n\t/* __tcp_retransmit_skb() */\n\tlen = cur_mss * segs;\t\t/* segs \u003e 1, no urg_mode check */\n\t...\n\t/* tcp_gso_segment(): bumps seq only, urg_ptr is copied */\n\nurg_ptr is an offset from the segment\u0027s own seq, so a copied value points\nat a different place on each segment. The receiver rebuilds the absolute\nurgent seq as seg.seq + urg_ptr, so it walks a moving urgent point instead\nof the one OOB byte:\n\n\tseg1  seq 1     urg_ptr 5001 -\u003e urgent @ 5001   (ok)\n\tseg2  seq 1001  urg_ptr 5001 -\u003e urgent @ 6001   (wrong, +MSS)\n\tseg3  seq 2001  urg_ptr 5001 -\u003e urgent @ 7001   (wrong, +2*MSS)\n\nThe real OOB byte is never pointed at, so the receiver stops splicing it\nout and delivers it as normal in-band data, corrupting the stream.\n\nGuard the retransmit length like the xmit path: keep segs = 1 while in\nurgent mode."
    }
  ],
  "id": "CVE-2026-90054",
  "lastModified": "2026-10-19T09:18:53.667",
  "metrics": {},
  "published": "2026-09-17T17:16:53.873",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/3d4e005c198dc410ad568f832bffa7569c059ff8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/47eb90299e6882d6445672530dd7c51ac33ebdbd"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/4fd2ee4ac154c204d95d8db72221446dac5af9b8"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/711bfd762bec05fb19bc3b17cbb157c39f4e66da"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/8eb51013b6308870479a64b4a2a018697b997849"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b8f08a94b2a4addc39249dcf9c792e786108621b"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ce2b807f42ed5e55567b8864ab72963f90779270"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/ebe55406404f3cb28e36d2b668e2c6c05026ec29"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.

Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

JSON
How durations are calculated

Following the VTEM framework (Black Hat USA 2015), time to patch starts when the vendor or a coordinator was informed, total time to patch at discovery, and disclosure to patch at public disclosure; vendor response time runs from the report to its acknowledgement. Time to exploit and time unpatched start at the earliest discovery or report, falling back to public disclosure. Unpatched time ends at the first recorded patch, or the calculation time when no patch is recorded. Exploitation to patch shows the interval between those two events; a published proof of concept is a public exploit, not exploitation.

Each result shows its source dates. A negative interval means the end event came first; when date-only inputs leave the order open, the result says so. Date-only inputs are approximate. The earliest evidence wins: KEV report dates and sightings are labelled as such. Records describing another vulnerability are listed but never calculated from, and a PoC alone does not establish exploitation. Missing patch evidence does not prove that no patch exists. Filters below change the event list only.

Loading timeline…




    Related by attack behaviour

    Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.