CVE-2026-98255

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: tcp: exclude old ACKs from tcp fast path Exclude old ACKs before SND.UNA from the tcp fast path as well as ACKs after SND.NXT. Such ACKs will fall through to the slow path, where tcp_ack() performs the appropriate validation and challenge ACK handling according to RFC5961 and Commit 3d501dd326fb1c7 ("tcp: do not accept ACK of bytes we never sent"). This prevents old ACKs from being accepted or modifying connection state as part of the fast path before appropriate ACK validation is applied. In particular, this prevents payload carried by a segment with an excessively old ACK from advancing RCV.NXT before the ACK is rejected.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98255

EUVD

EUVD-2026-93183

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	31770e34e43d6c8dee129bfee77e56c34e61f0e5
Linux	Linux	31770e34e43d6c8dee129bfee77e56c34e61f0e5
Linux	Linux	31770e34e43d6c8dee129bfee77e56c34e61f0e5
Linux	Linux	31770e34e43d6c8dee129bfee77e56c34e61f0e5
Linux	Linux	31770e34e43d6c8dee129bfee77e56c34e61f0e5
Linux	Linux	31770e34e43d6c8dee129bfee77e56c34e61f0e5
Linux	Linux	31770e34e43d6c8dee129bfee77e56c34e61f0e5
Linux	Linux	31770e34e43d6c8dee129bfee77e56c34e61f0e5
Linux	Linux	4.14

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves excluding old ACKs from the TCP fast path to prevent improper state changes. Old ACKs before SND.UNA or after SND.NXT are redirected to the slow path for proper validation per RFC5961 and Commit 3d501dd326fb1c7. This stops old ACKs from advancing connection state incorrectly.

Detection Guidance

This vulnerability is specific to the Linux kernel's TCP implementation and may not have direct detection commands. Monitor kernel logs for TCP-related errors or unexpected ACK handling. Use tools like tcpdump to capture network traffic and analyze ACK sequences. Check for kernel version and apply updates if vulnerable.

Impact Analysis

This vulnerability could allow attackers to send malformed TCP segments with old ACKs to manipulate connection state. This might lead to denial of service, data corruption, or unauthorized access if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a Linux kernel TCP protocol issue that could allow old ACKs to bypass validation, potentially disrupting network communication integrity. No evidence suggests it impacts data protection or privacy compliance requirements.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. If immediate updates are not possible, consider disabling TCP fast path features or applying kernel patches manually. Monitor system logs for signs of exploitation.

Hi! I’m here to help you understand CVE-2026-98255. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70