External risk intelligence

Linux Kernel TCP Retransmission Collapse Vulnerability.

CVE advisorySeverity: CRITICAL (CVSS 9.1)

CVE-2026-98549

This vulnerability is located deep within the Linux kernel TCP stack's retransmission and packet-collapsing logic. It involves internal buffer management (sk_write_queue/tcp_rtx_queue) related to device-specific encryption offloading (PSP/TLS). It is not directly reachable by network packets and requires complex internal kernel conditions to trigger, making it unavailable to external network-level exposure.

Halo Surface Signal: 1 out of 5 — much less likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in the Linux kernel's TCP processing could potentially allow data to be retransmitted in cleartext when using certain encryption offload features, or cause connection stalls in others. The main concern is confirming relevance and exposure due to the specific conditions required for exploitation.

Data can be sent unencrypted over networks.
Leadership should remember potential cleartext data exposure.
Confirm relevance and exposure to encryption features.

Attack Path

How an attacker could exploit the issue

An attacker could potentially compromise network security by exploiting a vulnerability within the Linux kernel's TCP transmission queue. This issue arises when data packets are being retransmitted or reordered, particularly when device encryption is involved. If certain conditions are met during this process, a specially crafted packet could be merged with an earlier one, leading to data being sent unencrypted or causing connection stalls.

No specific access required.
Triggered by packet retransmission logic.
Risk of unencrypted data transmission.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow data being transmitted over a TCP connection to be sent in cleartext or cause connections to stall, specifically when device encryption or TLS offload features are in use and specific retransmission conditions occur.

Sensitive data could be exposed.
Data encryption or offload features could fail.
Connections may stall or leak data.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability resides in the Linux kernel's TCP transmission queue, affecting how data is handled during retransmissions when encryption is involved. Identifying affected systems involves understanding which kernel instances are in use and if they participate in network traffic that utilizes specific encryption offload features. The first practical step is to locate these kernel instances, assess their exposure, and determine the accountable team before planning remediation.

Kernel and infrastructure teams own this.
Verify encryption offload feature usage.
Plan kernel updates during maintenance.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the Linux kernel TCP stack?

The TCP stack is a fundamental component of the Linux kernel that handles network data transmission. It manages how information is packaged, sent, and received over network connections. This specific vulnerability involves how the kernel organizes data in queues during transmission, specifically when the system uses advanced hardware features like Platform Security Processor (PSP) encryption or TLS device offloading to speed up network security tasks.

What is the vulnerability weakness in CVE-2026-98549?

The weakness involves improper memory management during the 'collapsing' of data packets. Normally, the kernel combines small packets into larger ones to be efficient. In this case, the kernel fails to respect boundaries between encrypted and unencrypted data when retransmitting packets. This logical error can lead to sensitive data being sent without intended encryption or causing the network connection to stop functioning entirely.

When does this vulnerability trigger?

The issue triggers during specific kernel operations like packet retransmissions or SACK shifts. For the bug to manifest, the system must be using specific encryption offload features and experience a scenario where data packets created after an encryption state change are incorrectly merged with earlier packets. Simply sending standard network traffic does not trigger this; it requires precise conditions within the internal kernel queue management.

How likely is external exposure for CVE-2026-98549?

According to Halo Surface Signal, external exposure is very unlikely. The vulnerability is buried deep within internal Linux kernel logic related to hardware-specific encryption tasks. Because it requires complex, internal kernel conditions rather than direct network commands, it cannot be triggered by standard external network-level interactions or malicious packets from the internet.

What should I do if my systems run this kernel?

First, identify which of your servers or infrastructure components are running the affected Linux kernel versions. Next, determine if those systems are actively using encryption offload features like PSP or TLS hardware offload. If they are, coordinate with your infrastructure or kernel maintenance teams to schedule a standard kernel update during your next planned maintenance window to apply the necessary stability and security fixes.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.