Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-90054— tcp: fix corruption of urgent data on multi-segment retransmit

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

以下是这段 Linux 内核漏洞描述的中文翻译： 在 Linux 内核中，已修复以下漏洞： tcp：修复多段重传时紧急数据损坏的问题 在正常的发送（xmit）路径中，当处于紧急模式（urgent mode）时，我们拒绝构建多段 TSO 数据包，因此每个段都有自己独立的 （紧急指针）： 而重传（retransmit）路径没有这样的保护机制。 会构建一个包含多个段（segs > 1）的 skb，并将其交给 GSO 层处理。GSO 层仅为每个段递增 ，并原样复制 ： 是相对于段自身 的偏移量，因此复制后的值在每个段上指向

AI Predicted 5.3 Difficulty: Hard EPSS 0.22% · P11

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux 10d3be569243def8d92ac3722395ef5a59c504e6< 8eb51013b6308870479a64b4a2a018697b997849 affected
10d3be569243def8d92ac3722395ef5a59c504e6< 711bfd762bec05fb19bc3b17cbb157c39f4e66da affected
10d3be569243def8d92ac3722395ef5a59c504e6< 3d4e005c198dc410ad568f832bffa7569c059ff8 affected
10d3be569243def8d92ac3722395ef5a59c504e6< 4fd2ee4ac154c204d95d8db72221446dac5af9b8 affected
10d3be569243def8d92ac3722395ef5a59c504e6< ebe55406404f3cb28e36d2b668e2c6c05026ec29 affected
10d3be569243def8d92ac3722395ef5a59c504e6< b8f08a94b2a4addc39249dcf9c792e786108621b affected
10d3be569243def8d92ac3722395ef5a59c504e6< 47eb90299e6882d6445672530dd7c51ac33ebdbd affected
10d3be569243def8d92ac3722395ef5a59c504e6< ce2b807f42ed5e55567b8864ab72963f90779270 affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-90054

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
tcp: fix corruption of urgent data on multi-segment retransmit
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urg_ptr: /* tcp_write_xmit() */ limit = mss_now; if (tso_segs > 1 && !tcp_urg_mode(tp)) limit = tcp_mss_split_point(...); The retransmit path has no such guard. __tcp_retransmit_skb() builds a segs > 1 skb and hands it to the GSO layer, which only advances th->seq per segment and copies urg_ptr verbatim: /* __tcp_retransmit_skb() */ len = cur_mss * segs; /* segs > 1, no urg_mode check */ ... /* tcp_gso_segment(): bumps seq only, urg_ptr is copied */ urg_ptr is an offset from the segment's own seq, so a copied value points at a different place on each segment. The receiver rebuilds the absolute urgent seq as seg.seq + urg_ptr, so it walks a moving urgent point instead of the one OOB byte: seg1 seq 1 urg_ptr 5001 -> urgent @ 5001 (ok) seg2 seq 1001 urg_ptr 5001 -> urgent @ 6001 (wrong, +MSS) seg3 seq 2001 urg_ptr 5001 -> urgent @ 7001 (wrong, +2*MSS) The real OOB byte is never pointed at, so the receiver stops splicing it out and delivers it as normal in-band data, corrupting the stream. Guard the retransmit length like the xmit path: keep segs = 1 while in urgent mode.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux 10d3be569243def8d92ac3722395ef5a59c504e6 ~ 8eb51013b6308870479a64b4a2a018697b997849 -
Linux Linux 4.7 -

II. Public POCs for CVE-2026-90054

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-90054

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-90054 (8)

Same Patch Batch · Linux · 2026-09-17 · 600 CVEs total

CVE-2026-90173 9.8 CRITICAL smb: smbdirect: free completion queues with ib_free_cq()
CVE-2026-92489 9.8 CRITICAL xfrm: Fix skb double-free in xfrm_dev_direct_output()
CVE-2026-90104 9.8 CRITICAL NFSv4.1: zero referring call lists before decoding
CVE-2026-90235 9.8 CRITICAL sunrpc: xprtsock: annotate shared socket callbacks with READ_ONCE/WRITE_ONCE
CVE-2026-90151 9.8 CRITICAL NFSv4: remove callback IDR entry on client allocation failure
CVE-2026-90110 9.4 CRITICAL inetpeer: randomize RB-tree node comparison using SipHash
CVE-2026-90414 9.1 CRITICAL IB/isert: reject PDUs declaring more data than was received
CVE-2026-90413 9.1 CRITICAL IB/isert: reject login PDUs declaring more data than was received
CVE-2026-90230 9.1 CRITICAL nvmet: fix heap out-of-bounds read in nvmet_auth_negotiate()
CVE-2026-90381 8.8 HIGH wifi: mt76: fix handling channel context with different bands in mt76_switch_vif_chanctx()
CVE-2026-90329 8.8 HIGH HID: synchronize input before cleaning up a failed probe
CVE-2026-90162 8.8 HIGH ksmbd: defer publishing granted locks to prevent UAF/double-free race
CVE-2026-90357 8.8 HIGH wifi: mt76: mt7915: unlink TWT flow if the MCU rejects the agreement
CVE-2026-90367 8.8 HIGH wifi: mt76: mt7996: hold dev->mt76.mutex while disabling tx worker in SER
CVE-2026-90371 8.8 HIGH wifi: mt76: fix RXDMAD_C buffer recycling race
CVE-2026-93042 8.8 HIGH dmaengine: dw-edma: Terminate all descriptors without callbacks
CVE-2026-90425 8.8 HIGH iommu/tegra241-cmdqv: Require exactly one Stream ID for a vSID
CVE-2026-90240 8.8 HIGH iommu/vt-d: Flush context cache with correct SID when tearing down aliases
CVE-2026-90379 8.8 HIGH wifi: mt76: mt7921: Add PCIe AER handler support to prevent system crash
CVE-2026-90256 8.8 HIGH Bluetooth: L2CAP: use proto_lock for l2cap_data to fix l2cap_disconn_ind

Showing top 20 of 600 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-90054

No comments yet

Leave a comment