)]}'
{
  "commit": "fe99bbeee5c5dbd3abc30721a8079ced59649d97",
  "tree": "a983718e1dd5f2de4f05cfc58217735bea003abf",
  "parents": [
    "26cc0e69cce062cd3aa6fae33074684669c35a71"
  ],
  "author": {
    "name": "Yilin Zhang",
    "email": "yilinzhang@moonshot.ai",
    "time": "Thu Sep 24 12:49:00 2026 +0800"
  },
  "committer": {
    "name": "Jakub Kicinski",
    "email": "kuba@kernel.org",
    "time": "Thu Sep 24 09:17:10 2026 -0700"
  },
  "message": "tcp: fix use-after-free of retransmit_skb_hint in tcp_send_synack()\n\nWhen tcp_send_synack() replaces the cloned SYN skb at the head of the\nretransmit queue with a copy, it frees the original with\ntcp_rtx_queue_unlink_and_free() and only repairs tp-\u003ehighest_sack.\ntp-\u003eretransmit_skb_hint keeps pointing at the freed\nskbuff_fclone_cache object.\n\nThe dangling hint is read in tcp_verify_retransmit_hint() and used as\nthe root of the rbtree walk in tcp_xmit_retransmit_queue().  An\nunprivileged TFO client (sendmsg(MSG_FASTOPEN)) can arm the hint with\nan attacker-supplied ICMP fragmentation-needed message, after which a\nsimultaneous open frees the armed SYN skb:\n\n  BUG: KASAN: slab-use-after-free in tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n  Read of size 4 at addr ffff88800604d928 by task swapper/1/0\n  Call Trace:\n   tcp_mark_skb_lost (net/ipv4/tcp_input.c:1316)\n   tcp_simple_retransmit (net/ipv4/tcp_input.c:3158)\n   tcp_v4_err (net/ipv4/tcp_ipv4.c:587)\n\nSync the hint to the copy.\n\nFixes: c31b70c9968f (\"tcp: Add logic to check for SYN w/ data in tcp_simple_retransmit\")\nReported-by: Kimi Security Team \u003cbug-report@moonshot.ai\u003e\nTested-by: Weiming Shi \u003cshiweiming@moonshot.ai\u003e\nSigned-off-by: Yilin Zhang \u003cyilinzhang@moonshot.ai\u003e\nReviewed-by: Eric Dumazet \u003cedumazet@google.com\u003e\nLink: https://patch.msgid.link/8a9dff4063a2745653b7e88ceb745d75efa16e68.1790224474.git.yilinzhang@moonshot.ai\nSigned-off-by: Jakub Kicinski \u003ckuba@kernel.org\u003e\n",
  "tree_diff": [
    {
      "type": "modify",
      "old_id": "d960e3de7d50d010383c39649f57df2965b5430b",
      "old_mode": 33188,
      "old_path": "net/ipv4/tcp_output.c",
      "new_id": "e0c392e29de5a448fc22ad87ce986514285e61de",
      "new_mode": 33188,
      "new_path": "net/ipv4/tcp_output.c"
    }
  ]
}