CVE-2026-64007 (GCVE-0-2026-64007)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-08-05 12:38
VLAI
Title
netfilter: synproxy: refresh tcphdr after skb_ensure_writable
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain that pointer with skb_header_pointer() before calling in, so it may either alias skb->head directly or point at the caller's on-stack _tcph buffer. Between obtaining the pointer and using it, the function calls skb_ensure_writable(skb, optend), which on a cloned or non-linear skb invokes pskb_expand_head() and frees the old skb->head. After that point the cached th is stale: caller (ipv[46]_synproxy_hook) th = skb_header_pointer(skb, ..., &_tcph) synproxy_tstamp_adjust(skb, protoff, th, ...) skb_ensure_writable(skb, optend) pskb_expand_head() /* kfree(old skb->head) */ ... inet_proto_csum_replace4(&th->check, ...) /* writes into freed head, or into the caller's stack copy leaving the on-wire checksum stale */ The option bytes are written through skb->data and are fine; only the checksum update goes through th and so lands in the wrong place. The result is either a write into freed slab memory or a packet leaving with a checksum that does not match its payload. Fix by re-deriving th from skb->data + protoff immediately after skb_ensure_writable() succeeds, so the subsequent checksum update targets the linear, writable header.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < 9902a1058992de5d95656b64a3bd95c077f7ba2c (git)
Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < d3019c61799adc21811af4b521f11f3dc77f8e04 (git)
Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < dd206819f210522579010d889d45a9530bb494bc (git)
Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < af2c22ccb1f621aff487ff47a040e38e058541e7 (git)
Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < c7f945f7da097245a2f8ed7775ce48421047ee96 (git)
Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < f0fea2b6d5453a11ad11713bbf37561b9b3a7edf (git)
Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < a91887a5b6ee4b98dfbf1db657ed2b879430149e (git)
Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < 92170e6afe927ab2792a3f71902845789c8e31b1 (git)
Create a notification for this product.
Linux Linux Affected: 3.12
Unaffected: 0 , < 3.12 (semver)
Unaffected: 5.10.259 , ≤ 5.10.* (semver)
Unaffected: 5.15.210 , ≤ 5.15.* (semver)
Unaffected: 6.1.176 , ≤ 6.1.* (semver)
Unaffected: 6.6.143 , ≤ 6.6.* (semver)
Unaffected: 6.12.93 , ≤ 6.12.* (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.12 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_synproxy_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9902a1058992de5d95656b64a3bd95c077f7ba2c",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "d3019c61799adc21811af4b521f11f3dc77f8e04",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "dd206819f210522579010d889d45a9530bb494bc",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "af2c22ccb1f621aff487ff47a040e38e058541e7",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "c7f945f7da097245a2f8ed7775ce48421047ee96",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "f0fea2b6d5453a11ad11713bbf37561b9b3a7edf",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "a91887a5b6ee4b98dfbf1db657ed2b879430149e",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "92170e6afe927ab2792a3f71902845789c8e31b1",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_synproxy_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: refresh tcphdr after skb_ensure_writable\n\nsynproxy_tstamp_adjust() rewrites the TCP timestamp option in place\nand then patches the TCP checksum via inet_proto_csum_replace4() on\nthe caller-supplied tcphdr pointer.  Both ipv4_synproxy_hook() and\nipv6_synproxy_hook() obtain that pointer with skb_header_pointer()\nbefore calling in, so it may either alias skb-\u003ehead directly or\npoint at the caller\u0027s on-stack _tcph buffer.\n\nBetween obtaining the pointer and using it, the function calls\nskb_ensure_writable(skb, optend), which on a cloned or non-linear\nskb invokes pskb_expand_head() and frees the old skb-\u003ehead.  After\nthat point the cached th is stale:\n\n    caller (ipv[46]_synproxy_hook)\n      th = skb_header_pointer(skb, ..., \u0026_tcph)\n      synproxy_tstamp_adjust(skb, protoff, th, ...)\n        skb_ensure_writable(skb, optend)\n          pskb_expand_head()        /* kfree(old skb-\u003ehead) */\n        ...\n        inet_proto_csum_replace4(\u0026th-\u003echeck, ...)\n                                    /* writes into freed head, or\n                                       into the caller\u0027s stack copy\n                                       leaving the on-wire checksum\n                                       stale */\n\nThe option bytes are written through skb-\u003edata and are fine; only\nthe checksum update goes through th and so lands in the wrong\nplace.  The result is either a write into freed slab memory or a\npacket leaving with a checksum that does not match its payload.\n\nFix by re-deriving th from skb-\u003edata + protoff immediately after\nskb_ensure_writable() succeeds, so the subsequent checksum update\ntargets the linear, writable header."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is triggered when remote TCP packets traverse SYNPROXY netfilter hooks (NF_INET_LOCAL_IN / NF_INET_POST_ROUTING) on a host with SYNPROXY configured, which is the standard internet-facing firewall/router deployment for this subsystem.\nAC:L - An attacker who controls a TCP session through SYNPROXY can reliably send timestamp-bearing packets to hit the vulnerable path; the stale-pointer UAF write occurs whenever skb_ensure_writable() must expand a cloned skb, which the attacker can influence by sustaining traffic on the proxied connection.\nPR:N - Exploitation requires only that the victim already runs SYNPROXY (normal for protected services); the remote attacker needs no credentials or local privileges on the target system to send the triggering TCP packets.\nUI:N - No victim user action is required beyond normal network operation; exploitation is fully automated via crafted or sustained TCP traffic through the SYNPROXY session.\nS:U - Impact is confined to kernel memory on the affected host running SYNPROXY; this is standard kernel privilege escalation/memory corruption, not a cross-VM or cross-security-boundary escape.\nC:H - The stale tcphdr pointer causes inet_proto_csum_replace4() to write into freed slab memory, a use-after-free class bug that can be leveraged for arbitrary kernel memory read via heap grooming techniques.\nI:H - The out-of-bounds write into freed slab memory via a stale tcphdr pointer is a use-after-free write primitive that can be developed into arbitrary kernel memory writes and local privilege escalation.\nA:H - Writing into freed slab memory can corrupt adjacent kernel objects and cause kernel oops, panic, or crash, and UAF conditions are inherently capable of destabilizing the system even during exploitation attempts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:06.995Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf"
        },
        {
          "url": "https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e"
        },
        {
          "url": "https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1"
        }
      ],
      "title": "netfilter: synproxy: refresh tcphdr after skb_ensure_writable",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64007",
    "datePublished": "2026-07-19T14:56:23.049Z",
    "dateReserved": "2026-07-19T07:54:57.026Z",
    "dateUpdated": "2026-08-05T12:38:06.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64007",
      "date": "2026-08-10",
      "epss": "0.00514",
      "percentile": "0.41013"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64007\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:40.407\",\"lastModified\":\"2026-07-30T14:51:20.077\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nnetfilter: synproxy: refresh tcphdr after skb_ensure_writable\\n\\nsynproxy_tstamp_adjust() rewrites the TCP timestamp option in place\\nand then patches the TCP checksum via inet_proto_csum_replace4() on\\nthe caller-supplied tcphdr pointer.  Both ipv4_synproxy_hook() and\\nipv6_synproxy_hook() obtain that pointer with skb_header_pointer()\\nbefore calling in, so it may either alias skb-\u003ehead directly or\\npoint at the caller\u0027s on-stack _tcph buffer.\\n\\nBetween obtaining the pointer and using it, the function calls\\nskb_ensure_writable(skb, optend), which on a cloned or non-linear\\nskb invokes pskb_expand_head() and frees the old skb-\u003ehead.  After\\nthat point the cached th is stale:\\n\\n    caller (ipv[46]_synproxy_hook)\\n      th = skb_header_pointer(skb, ..., \u0026_tcph)\\n      synproxy_tstamp_adjust(skb, protoff, th, ...)\\n        skb_ensure_writable(skb, optend)\\n          pskb_expand_head()        /* kfree(old skb-\u003ehead) */\\n        ...\\n        inet_proto_csum_replace4(\u0026th-\u003echeck, ...)\\n                                    /* writes into freed head, or\\n                                       into the caller\u0027s stack copy\\n                                       leaving the on-wire checksum\\n                                       stale */\\n\\nThe option bytes are written through skb-\u003edata and are fine; only\\nthe checksum update goes through th and so lands in the wrong\\nplace.  The result is either a write into freed slab memory or a\\npacket leaving with a checksum that does not match its payload.\\n\\nFix by re-deriving th from skb-\u003edata + protoff immediately after\\nskb_ensure_writable() succeeds, so the subsequent checksum update\\ntargets the linear, writable header.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"net/netfilter/nf_synproxy_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"48b1de4c110a7afa4b85862f6c75af817db26fad\",\"lessThan\":\"9902a1058992de5d95656b64a3bd95c077f7ba2c\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48b1de4c110a7afa4b85862f6c75af817db26fad\",\"lessThan\":\"d3019c61799adc21811af4b521f11f3dc77f8e04\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48b1de4c110a7afa4b85862f6c75af817db26fad\",\"lessThan\":\"dd206819f210522579010d889d45a9530bb494bc\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48b1de4c110a7afa4b85862f6c75af817db26fad\",\"lessThan\":\"af2c22ccb1f621aff487ff47a040e38e058541e7\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48b1de4c110a7afa4b85862f6c75af817db26fad\",\"lessThan\":\"c7f945f7da097245a2f8ed7775ce48421047ee96\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48b1de4c110a7afa4b85862f6c75af817db26fad\",\"lessThan\":\"f0fea2b6d5453a11ad11713bbf37561b9b3a7edf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48b1de4c110a7afa4b85862f6c75af817db26fad\",\"lessThan\":\"a91887a5b6ee4b98dfbf1db657ed2b879430149e\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"48b1de4c110a7afa4b85862f6c75af817db26fad\",\"lessThan\":\"92170e6afe927ab2792a3f71902845789c8e31b1\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"net/netfilter/nf_synproxy_core.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"3.12\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"3.12\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.259\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.210\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.176\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.143\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.93\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.35\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.12\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-05T14:05:06+00:00",
      "cve": "CVE-2026-64007",
      "id": "CVE-2026-64007",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "260",
      "product_status:known_not_affected": "15",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64007.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-07-21T13:01:41Z",
      "cve": "CVE-2026-64007",
      "id": "CVE-2026-64007",
      "initial_release_date": "2026-07-21T13:01:41Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64007",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64007.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.