tcp: fix corruption of urgent data on multi-segment retransmit

{
  "id": "7f7f37ca7865acfa5e341cc1b443d98bb14acf4fcc63ba53c11277843334740e",
  "url": "https://osv.dev/vulnerability/CVE-2026-90054",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "tcp: fix corruption of urgent data on multi-segment retransmit",
    "summary": "In the Linux kernel, the following vulnerability has been resolved: tcp: fix corruption of urgent data on multi-segment retransmit On the normal xmit path, while in urgent mode we refuse to build a multi-segment TSO packet, so every segment gets its own urg_ptr: /* tcp_write_xmit() */ limit = mss_now; if (tso_segs > 1 && !tcp_urg_mode(tp)) limit = tcp_mss_split_point(...); The retransmit path has no such guard. __tcp_retransmit_skb() builds a segs > 1 skb and hands it to the GSO layer, which only advances th->seq per segment and copies urg_ptr verbatim: /* __tcp_retransmit_skb() */ len = cur_mss * segs; /* segs > 1, no urg_mode check */ ... /* tcp_gso_segment(): bumps seq only, urg_ptr is copied */ urg_ptr is an offset from the segment's own seq, so a copied value points at a different place on each segment. The receiver rebuilds the absolute urgent seq as seg.seq + urg_ptr, so it walks a moving urgent point instead of the one OOB byte: seg1 seq 1 urg_ptr 5001 -> urgent @ 5001 (ok) seg2 seq 1001 urg_ptr 5001 -> urgent @ 6001 (wrong, +MSS) seg3 seq 2001 urg_ptr 5001 -> urgent @ 7001 (wrong, +2*MSS) The real OOB byte is never pointed at, so the receiver stops splicing it out and delivers it as normal in-band data, corrupting the stream. Guard the retransmit length like the xmit path: keep segs = 1 while in urgent mode.",
    "evidence": "osv:CVE-2026-90054",
    "products": [
      {
        "name": {
          "value": "Kernel",
          "evidence": "/affected/1/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [
          {
            "value": "5.10.270",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "5.15.221",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.1.188",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.6.157",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.12.110",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "6.18.52",
            "evidence": "/affected/1/ranges"
          },
          {
            "value": "7.2.6",
            "evidence": "/affected/1/ranges"
          }
        ],
        "affected_versions": []
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "CVE-2026-90054",
      "aliases": [
        "CVE-2026-90054"
      ],
      "affected": [
        {
          "ranges": [
            {
              "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
              "type": "GIT",
              "events": [
                {
                  "introduced": "10d3be569243def8d92ac3722395ef5a59c504e6"
                },
                {
                  "fixed": "8eb51013b6308870479a64b4a2a018697b997849"
                },
                {
                  "fixed": "711bfd762bec05fb19bc3b17cbb157c39f4e66da"
                },
                {
                  "fixed": "3d4e005c198dc410ad568f832bffa7569c059ff8"
                },
                {
                  "fixed": "4fd2ee4ac154c204d95d8db72221446dac5af9b8"
                },
                {
                  "fixed": "ebe55406404f3cb28e36d2b668e2c6c05026ec29"
                },
                {
                  "fixed": "b8f08a94b2a4addc39249dcf9c792e786108621b"
                },
                {
                  "fixed": "47eb90299e6882d6445672530dd7c51ac33ebdbd"
                },
                {
                  "fixed": "ce2b807f42ed5e55567b8864ab72963f90779270"
                }
              ]
            }
          ],
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90054.json"
          }
        },
        {
          "ranges": [
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "4.7.0"
                },
                {
                  "fixed": "5.10.270"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.11.0"
                },
                {
                  "fixed": "5.15.221"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "5.16.0"
                },
                {
                  "fixed": "6.1.188"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.2.0"
                },
                {
                  "fixed": "6.6.157"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.7.0"
                },
                {
                  "fixed": "6.12.110"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.13.0"
                },
                {
                  "fixed": "6.18.52"
                }
              ]
            },
            {
              "type": "ECOSYSTEM",
              "events": [
                {
                  "introduced": "6.19.0"
                },
                {
                  "fixed": "7.2.6"
                }
              ]
            }
          ],
          "package": {
            "name": "Kernel",
            "ecosystem": "Linux"
          },
          "database_specific": {
            "source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-90054.json"
          }
        }
      ],
      "modified": "2026-10-28T02:30:26.459196834Z",
      "provider": "osv",
      "references": [
        "https://git.kernel.org/stable/c/3d4e005c198dc410ad568f832bffa7569c059ff8",
        "https://git.kernel.org/stable/c/47eb90299e6882d6445672530dd7c51ac33ebdbd",
        "https://git.kernel.org/stable/c/4fd2ee4ac154c204d95d8db72221446dac5af9b8",
        "https://git.kernel.org/stable/c/711bfd762bec05fb19bc3b17cbb157c39f4e66da",
        "https://git.kernel.org/stable/c/8eb51013b6308870479a64b4a2a018697b997849",
        "https://git.kernel.org/stable/c/b8f08a94b2a4addc39249dcf9c792e786108621b",
        "https://git.kernel.org/stable/c/ce2b807f42ed5e55567b8864ab72963f90779270",
        "https://git.kernel.org/stable/c/ebe55406404f3cb28e36d2b668e2c6c05026ec29",
        "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90054.json",
        "https://nvd.nist.gov/vuln/detail/CVE-2026-90054",
        "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
      ],
      "provider_metadata": {
        "cna_assigner": "Linux",
        "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/90xxx/CVE-2026-90054.json"
      }
    },
    "related_cves": [
      {
        "value": "CVE-2026-90054",
        "evidence": "/id"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 493085,
  "published_at": "2026-09-17T16:05:39.632+00:00"
}