SB20261022125 - Cleartext transmission of sensitive information in Linux kernel net

Description

This security bulletin contains information about 1 vulnerability.

1) Cleartext transmission of sensitive information (CVE-ID: CVE-2026-98549)

CWE-ID: CWE-319 - Cleartext Transmission of Sensitive Information

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to disclose transmitted data or cause a denial of service under affected device-encryption conditions.

The vulnerability exists due to improper enforcement of encryption boundaries in Linux kernel TCP buffer collapsing when retransmission or SACK shifting merges buffers queued before and after a switch to device encryption. A remote attacker can exploit this cross-boundary merging to cause PSP data to be retransmitted in cleartext or TLS device-offloaded connections to stall.

The vulnerable condition occurs when the write queue is empty at the encryption switch while earlier, unacknowledged buffers remain in the retransmission queue.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/08e835f5ec6e261c79d8c39f8618b3af29e3b0da
• https://git.kernel.org/stable/c/1ae7aee395245874d797890380d9192bd858fb7e
• https://git.kernel.org/stable/c/7ba87509c54cd519e7ed362e0c85e8431f066a18
• https://git.kernel.org/stable/c/9e2a2f98e8c0197108c6d97a1fa43bfd89071c30
• https://git.kernel.org/stable/c/fc6d80eb504458d6416b75a94188b268c95c6533