CVE-2026-90054

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the TCP retransmit path where the system fails to restrict the creation of multi-segment packets while in urgent mode. Unlike the normal transmission path, the tcp retransmit skb() function allows the construction of packets with multiple segments, which are then processed by the GSO layer. Because the urg ptr is copied verbatim across segments without adjustment, the receiver calculates an incorrect absolute urgent sequence for each subsequent segment. This causes the receiver to treat the out-of-band (OOB) byte as normal in-band data, leading to stream corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.