CVE-2026-98255

The TCP established fast path can accept a segment whose ACK is older than SND.UNA because the previous prediction condition rejects ACK values after SND.NXT but does not reject ACK values before SND.UNA. If the segment also carries the expected receive sequence number and payload, the payload can be processed and RCV.NXT can advance before the old ACK receives full validation in the slow path. This creates a network data injection and TCP state manipulation risk rather than a memory corruption issue. For the CVSS the PR:N is selected because no authenticated account or local execution context is required when an attacker can send forged TCP segments to the established connection. Attack complexity is high because an off path attacker normally needs the connection tuple and a valid receive sequence number, while an on path attacker or an attacker with suitable network visibility has a more practical trigger path. Impact includes modification of an established byte stream and possible connection desynchronization or disruption. No UAF, OOB access, information disclosure, or direct privilege escalation primitive is identified.