tcp FastPath Bypass

Vulnerability analysis

The TCP fast path in the established receive path only checked that an incoming segment's ACK number did not exceed the next send sequence, but failed to verify it was not older than the oldest unacknowledged sequence. A segment carrying an excessively old ACK could therefore be accepted in the fast path, where its payload would advance the receive window and be delivered to the application before the slow path's ACK validation could reject the invalid ACK. The fix tightens the fast path condition to require the ACK number to fall within the valid send window range; any ACK outside that range now falls through to the slow path where standard RFC 5961 validation and challenge ACK handling apply. This is reachable over the network by any attacker who can deliver TCP segments to the target host, though exploitation requires knowledge of the target connection's sequence numbers, which is trivial for an on-path attacker and difficult but not impossible for an off-path one.