CVE-2026-98255 tcp: exclude old ACKs from tcp fast path
Attackers can send old TCP ACKs to bypass validation, potentially corrupting connection state or causing denial of service in the Linux kernel.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98255?
CVE-2026-98255 is a vulnerability in Linux, published on 6 Oct 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
tcp: exclude old ACKs from tcp fast path
Exclude old ACKs before SND.UNA from the tcp fast path as well as ACKs after SND.NXT.
Such ACKs will fall through to the slow path, where tcp_ack() performs the appropriate validation and challenge ACK handling according to RFC5961 and Commit 3d501dd326fb1c7 ("tcp: do not accept ACK of bytes we never sent").
This prevents old ACKs from being accepted or modifying connection state as part of the fast path before appropriate ACK validation is applied. In particular, this prevents payload carried by a segment with an excessively old ACK from advancing RCV.NXT before the ACK is rejected.
Which versions are affected by CVE-2026-98255?
How do I fix CVE-2026-98255?
Apply the vendor's patch.
Is CVE-2026-98255 being exploited?
There is no known exploitation of CVE-2026-98255 in the wild and no public exploit code.
Sources
Also known as AZL-106353, BELL-CVE-2026-98255, DEBIAN-CVE-2026-98255, GHSA-vm2w-hjrq-h79w, UBUNTU-CVE-2026-98255.