Executive brief
The Linux kernel TCP implementation incorrectly handles out-of-band urgent data when retransmitting multiple segments at once. This causes the receiver to misinterpret which bytes are marked urgent, delivering corrupted data to applications. The defect affects any system using TCP urgent mode, potentially corrupting critical data streams.
Technical details
This is a logic error in TCP segment retransmission (CVE-2026-90054). The normal transmission path prevents multi-segment TSO packets when in urgent mode, ensuring each segment has its own correct urgent pointer. The retransmit path (__tcp_retransmit_skb) lacks this guard and builds multi-segment packets with a single urgent pointer that is copied verbatim across all segments. Since urg_ptr is an offset from each segment's sequence number, the same pointer value points to different absolute positions in each segment, causing the receiver to chase a moving target instead of the actual OOB byte. An attacker or sender in urgent mode can trigger this by forcing retransmissions while sending urgent data; no authentication or special privileges are required. The fix adds a conditional to keep segment count to 1 when tcp_urg_mode() is true, mirroring the transmit path logic.
Affected products
- Linux Linux kernel multiple versions from 2.6.11 onwards (affects all active stable branches)
Timeline
- 2026-09-17: disclosed: CVE-2026-90054 published
- 2026-09-14: patched: Fix committed to stable kernel trees by Greg Kroah-Hartman
- 2026-08-26: other: Original upstream commit ce2b807f42ed5e55567b8864ab72963f90779270 by Jiayuan Chen