CVE-2026-98374

waiting for further signals

GHSA-2q84-vc4j-mp23 ↗EUVD-2026-94323 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

Linux 5.11

fixed in fad6d429651e748365e93ca54645accc212f0018, c5b4da1f403a658c1c19766be2b426003ada419f, 71d45049b0d631dfdbf3c65305f7fca676de023b, e3ea71cb1408a013ed4e8a757b815f1a919324bd, 631aa4cb45099f09e9385dd786bd291c6270bfc4, 0f87720c7e4bcab07c24888b3cf12bfe857bb90e, fe99bbeee5c5dbd3abc30721a8079ced59649d97

ETK-2026-949, permanent identifier

13d 14h 33msince last run

31mAI analysis

timeline

0 = trigger signal

trigger signal (cve.org) +0hwaiting for further signals+19h01m

+2h

+4h

+6h

+8h

+10h

description

Linux kernels with the affected TCP retransmission handling can retain a reference to a freed packet buffer during SYN-ACK processing. An unprivileged client using TCP Fast Open may trigger a kernel use-after-free when the required ICMP and simultaneous-open network conditions occur.

mitigation

Update to a Linux kernel release containing the applicable fix commit: fad6d429651e748365e93ca54645accc212f0018, c5b4da1f403a658c1c19766be2b426003ada419f, 71d45049b0d631dfdbf3c65305f7fca676de023b, e3ea71cb1408a013ed4e8a757b815f1a919324bd, 631aa4cb45099f09e9385dd786bd291c6270bfc4, 0f87720c7e4bcab07c24888b3cf12bfe857bb90e, or fe99bbeee5c5dbd3abc30721a8079ced59649d97. Until updated, reduce exposure by disabling or restricting TCP Fast Open where operationally feasible.

check

exploit

automation

contextual

auth required

–

EPSS

0.16%4th percentile

agent run time

31m

cve.org record, t = 0

2026-10-07 13:01Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual: an exploit technique exists, but no deterministic check could cover this one.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-10-07 13:01Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-98374

this entry in the feed

GET /api/v1/feed/CVE-2026-98374

{
  "etk_id": "ETK-2026-949",
  "cve_id": "CVE-2026-98374",
  "display_id": "CVE-2026-98374",
  "ghsa_id": "GHSA-2q84-vc4j-mp23",
  "euvd_id": "EUVD-2026-94323",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Use-after-free in Linux TCP SYN-ACK retransmission",
  "summary": "Linux kernels with the affected TCP retransmission handling can retain a reference to a freed packet buffer during SYN-ACK processing. An unprivileged client using TCP Fast Open may trigger a kernel use-after-free when the required ICMP and simultaneous-open network conditions occur.",
  "mitigation": "Update to a Linux kernel release containing the applicable fix commit: fad6d429651e748365e93ca54645accc212f0018, c5b4da1f403a658c1c19766be2b426003ada419f, 71d45049b0d631dfdbf3c65305f7fca676de023b, e3ea71cb1408a013ed4e8a757b815f1a919324bd, 631aa4cb45099f09e9385dd786bd291c6270bfc4, 0f87720c7e4bcab07c24888b3cf12bfe857bb90e, or fe99bbeee5c5dbd3abc30721a8079ced59649d97. Until updated, reduce exposure by disabling or restricting TCP Fast Open where operationally feasible.",
  "vendor": "Linux",
  "product": "Linux",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        ">= c31b70c9968fe9c4194d1b5d06d07596a3b680de, < fad6d429651e748365e93ca54645accc212f0018",
        ">= c31b70c9968fe9c4194d1b5d06d07596a3b680de, < c5b4da1f403a658c1c19766be2b426003ada419f",
        ">= c31b70c9968fe9c4194d1b5d06d07596a3b680de, < 71d45049b0d631dfdbf3c65305f7fca676de023b",
        ">= c31b70c9968fe9c4194d1b5d06d07596a3b680de, < e3ea71cb1408a013ed4e8a757b815f1a919324bd",
        ">= c31b70c9968fe9c4194d1b5d06d07596a3b680de, < 631aa4cb45099f09e9385dd786bd291c6270bfc4",
        ">= c31b70c9968fe9c4194d1b5d06d07596a3b680de, < 0f87720c7e4bcab07c24888b3cf12bfe857bb90e",
        ">= c31b70c9968fe9c4194d1b5d06d07596a3b680de, < fe99bbeee5c5dbd3abc30721a8079ced59649d97"
      ],
      "ecosystem": null,
      "fixed_versions": [
        "fad6d429651e748365e93ca54645accc212f0018",
        "c5b4da1f403a658c1c19766be2b426003ada419f",
        "71d45049b0d631dfdbf3c65305f7fca676de023b",
        "e3ea71cb1408a013ed4e8a757b815f1a919324bd",
        "631aa4cb45099f09e9385dd786bd291c6270bfc4",
        "0f87720c7e4bcab07c24888b3cf12bfe857bb90e",
        "fe99bbeee5c5dbd3abc30721a8079ced59649d97"
      ],
      "package_name": "Linux",
      "purl": null
    },
    {
      "affected_notes": [],
      "affected_ranges": [
        "5.11"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Linux",
      "purl": null
    }
  ],
  "cwes": null,
  "cvss_score": null,
  "cvss_src": null,
  "cvss_vector": null,
  "epss_score": 0.0016,
  "epss_percentile": 0.0492,
  "epss_asof": "2026-10-21",
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 31.49141283333333,
  "t0_at": "2026-10-07T13:01:48.600000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-10-07T13:01:48.600000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-10-07T13:01:48.600000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-98374"
    }
  }
}

published 2026-10-08 07:31Z
last change 2026-10-21 22:34Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.