In the Linux kernel, the following vulnerability has been resolved: tcp: prevent collapsing skbs across boundary in rtx queue… (CVE-2026-98549)

The vulnerability in the Linux kernel TCP implementation relates to the function tcp_write_collapse_fence(), which sets a fence to prevent socket buffers (skbs) queued after a switch to device encryption from being collapsed into earlier skbs. However, if earlier data remains unacknowledged in the retransmission queue (tcp_rtx_queue), subsequent retransmissions or SACK shifts could merge skbs across this boundary. This merging can cause two issues: (1) for PSP devices, merged skbs may retain a decrypted flag of 0 from earlier skbs, causing retransmission of data in cleartext after encryption is expected; (2) for TLS device offload, merged skbs straddling the start marker cause software fallbacks and certain drivers to drop the skb, resulting in connection stalls. The fix applies a fallback in tcp_write_collapse_fence() and adds a check in tcp_skb_can_collapse() to prevent collapsing skbs with differing decrypted states, providing defense in depth.

The vulnerability can lead to retransmission of sensitive data in cleartext when device encryption is expected, potentially exposing data confidentiality. Additionally, it can cause connection stalls due to dropped packets in TLS device offload scenarios. There is no indication of active exploitation in the wild. The impact affects TCP connections using device encryption or TLS offload in the Linux kernel.

A fix has been implemented in the Linux kernel to address this vulnerability by improving the fencing mechanism and adding checks to prevent collapsing skbs across encryption boundaries. Users should apply the official kernel updates containing these fixes when available. Since this is a kernel-level issue, updating to a patched kernel version is the recommended remediation. Patch status is not explicitly stated; check the vendor advisory or Linux kernel mailing lists for the specific fixed versions and updates.