Cleartext transmission of sensitive information in Linux kernel - CVE-2026-98549

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU156851

Cleartext transmission of sensitive information in Linux kernel - CVE-2026-98549

Published: October 22, 2026


Vulnerability identifier: #VU156851
CSH Severity: Medium
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-98549
CWE-ID: CWE-319
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to disclose transmitted data or cause a denial of service under affected device-encryption conditions.

The vulnerability exists due to improper enforcement of encryption boundaries in Linux kernel TCP buffer collapsing when retransmission or SACK shifting merges buffers queued before and after a switch to device encryption. A remote attacker can exploit this cross-boundary merging to cause PSP data to be retransmitted in cleartext or TLS device-offloaded connections to stall.

The vulnerable condition occurs when the write queue is empty at the encryption switch while earlier, unacknowledged buffers remain in the retransmission queue.


Affected software

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp (Ubuntu package)
linux-oracle (Ubuntu package)
linux-ibm (Ubuntu package)
linux-hwe-7.0 (Ubuntu package)
linux-oem-7.0 (Ubuntu package)

How to mitigate CVE-2026-98549

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - update to 7.0.0-42.42
linux-aws (Ubuntu package) - update to 7.0.0-1016.17
linux-gcp (Ubuntu package) - update to 7.0.0-1016.18
linux-oracle (Ubuntu package) - update to 7.0.0-1015.16
linux-ibm (Ubuntu package) - update to 7.0.0-1017.17
linux-hwe-7.0 (Ubuntu package) - update to 7.0.0-42.42~24.04.1
linux-oem-7.0 (Ubuntu package) - update to 7.0.0-1017.17

External References

Related Security Bulletins