CVE-2026-64024 (GCVE-0-2026-64024)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:39 – Updated: 2026-08-05 12:38
VLAI
Title
tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
Summary
In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the producer (__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer (tcp_conn_request()): - min_ttl / min_hopcount check - xfrm policy check - tcp_inbound_hash() MD5/AO mismatch - tcp_filter() eBPF/SO_ATTACH_FILTER drop - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv() - tcp_checksum_complete() in tcp_v{4,6}_do_rcv() - tcp_v{4,6}_cookie_check() returning NULL When a packet is dropped on any of these paths, tcp_tw_isn is left set. The next SYN processed on the same CPU then consumes the non zero value in tcp_conn_request(), receiving a potentially predictable ISN. This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu variable. Note that tcp_v{4,6}_fill_cb() do not set it. Very litle impact on overall code size/complexity: $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7) Function old new delta tcp_v6_rcv 3038 3042 +4 tcp_v4_rcv 3035 3039 +4 tcp_conn_request 2938 2923 -15 Total: Before=24436060, After=24436053, chg -0.00%
Severity
9.4 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: 41eecbd712b73f0d5dcf1152b9a1c27b1f238028 , < e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd (git)
Affected: 41eecbd712b73f0d5dcf1152b9a1c27b1f238028 , < 4affe063fa56c880cbea8d0bfded0bb80751579d (git)
Affected: 41eecbd712b73f0d5dcf1152b9a1c27b1f238028 , < 1bbf0ced1d9db73ac7893c2187f3459288603e0d (git)
Create a notification for this product.
Linux Linux Affected: 6.10
Unaffected: 0 , < 6.10 (semver)
Unaffected: 6.18.34 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "include/net/tcp.h",
            "net/ipv4/tcp.c",
            "net/ipv4/tcp_input.c",
            "net/ipv4/tcp_ipv4.c",
            "net/ipv6/tcp_ipv6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd",
              "status": "affected",
              "version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028",
              "versionType": "git"
            },
            {
              "lessThan": "4affe063fa56c880cbea8d0bfded0bb80751579d",
              "status": "affected",
              "version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028",
              "versionType": "git"
            },
            {
              "lessThan": "1bbf0ced1d9db73ac7893c2187f3459288603e0d",
              "status": "affected",
              "version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "include/net/tcp.h",
            "net/ipv4/tcp.c",
            "net/ipv4/tcp_input.c",
            "net/ipv4/tcp_ipv4.c",
            "net/ipv6/tcp_ipv6.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.10"
            },
            {
              "lessThan": "6.10",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.34",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.34",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.10",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction\n\nBlamed commit moved the TIME_WAIT-derived ISN from the skb control\nblock to a per-CPU variable, assuming the value would always be consumed\nby tcp_conn_request() for the same packet that wrote it. That assumption\nis violated by multiple drop paths between the producer\n(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer\n(tcp_conn_request()):\n\n - min_ttl / min_hopcount check\n - xfrm policy check\n - tcp_inbound_hash() MD5/AO mismatch\n - tcp_filter() eBPF/SO_ATTACH_FILTER drop\n - th-\u003esyn \u0026\u0026 th-\u003efin discard in tcp_rcv_state_process() TCP_LISTEN\n - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()\n - tcp_checksum_complete() in tcp_v{4,6}_do_rcv()\n - tcp_v{4,6}_cookie_check() returning NULL\n\nWhen a packet is dropped on any of these paths, tcp_tw_isn is left set.\n\nThe next SYN processed on the same CPU then consumes the non zero value in\ntcp_conn_request(), receiving a potentially predictable ISN.\n\nThis patch moves back tcp_tw_isn to skb-\u003ecb[], getting rid of the per-cpu\nvariable.\n\nNote that tcp_v{4,6}_fill_cb() do not set it.\n\nVery litle impact on overall code size/complexity:\n\n$ scripts/bloat-o-meter -t vmlinux.old vmlinux.new\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7)\nFunction                                     old     new   delta\ntcp_v6_rcv                                  3038    3042      +4\ntcp_v4_rcv                                  3035    3039      +4\ntcp_conn_request                            2938    2923     -15\nTotal: Before=24436060, After=24436053, chg -0.00%"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.4,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The vulnerable code is reached from the standard IPv4/IPv6 TCP receive path (tcp_v4_rcv/tcp_v6_rcv) when remote attackers send crafted TCP packets to any listening service on the host.\nAC:L - An attacker fully controls the trigger sequence\u2014establishing TIME_WAIT state, deliberately causing drops on documented paths (e.g., SYN+FIN or checksum failure), and spraying SYNs to land on the same CPU via RPS flow hashing\u2014without depending on uncontrollable timing or memory layout.\nPR:N - Exploitation requires only the ability to send TCP packets to a reachable port; no local shell access, capabilities, or authentication is needed on the target system.\nUI:N - No victim user action is required; the attack is conducted entirely by sending network packets to an internet-facing or LAN-reachable server.\nS:U - Impact is confined to the kernel TCP stack on the target host (predictable ISNs, syncookie bypass, session manipulation) and does not cross a VM, container, or IOMMU security boundary.\nC:L - Stale TIME_WAIT ISNs leak predictable sequence-number information that an off-path attacker can use to infer or intercept data on affected TCP connections, bypassing the cryptographically generated ISNs from secure_tcp_seq_and_ts_off().\nI:H - Predictable server ISNs enable TCP session hijacking and injection of forged segments into established or newly accepted connections, plus syncookie bypass allows unauthorized connection state to be created under flood conditions.\nA:H - Skipping syncookie and SYN-backlog protections when a stale non-zero ISN is consumed allows unauthenticated resource exhaustion and connection-disruption attacks against listening services."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:18.798Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd"
        },
        {
          "url": "https://git.kernel.org/stable/c/4affe063fa56c880cbea8d0bfded0bb80751579d"
        },
        {
          "url": "https://git.kernel.org/stable/c/1bbf0ced1d9db73ac7893c2187f3459288603e0d"
        }
      ],
      "title": "tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64024",
    "datePublished": "2026-07-19T15:39:16.598Z",
    "dateReserved": "2026-07-19T07:54:57.027Z",
    "dateUpdated": "2026-08-05T12:38:18.798Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64024",
      "date": "2026-08-11",
      "epss": "0.00385",
      "percentile": "0.31454"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64024\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-19T16:17:42.413\",\"lastModified\":\"2026-07-30T14:59:47.950\",\"vulnStatus\":\"Awaiting Analysis\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\ntcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction\\n\\nBlamed commit moved the TIME_WAIT-derived ISN from the skb control\\nblock to a per-CPU variable, assuming the value would always be consumed\\nby tcp_conn_request() for the same packet that wrote it. That assumption\\nis violated by multiple drop paths between the producer\\n(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer\\n(tcp_conn_request()):\\n\\n - min_ttl / min_hopcount check\\n - xfrm policy check\\n - tcp_inbound_hash() MD5/AO mismatch\\n - tcp_filter() eBPF/SO_ATTACH_FILTER drop\\n - th-\u003esyn \u0026\u0026 th-\u003efin discard in tcp_rcv_state_process() TCP_LISTEN\\n - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()\\n - tcp_checksum_complete() in tcp_v{4,6}_do_rcv()\\n - tcp_v{4,6}_cookie_check() returning NULL\\n\\nWhen a packet is dropped on any of these paths, tcp_tw_isn is left set.\\n\\nThe next SYN processed on the same CPU then consumes the non zero value in\\ntcp_conn_request(), receiving a potentially predictable ISN.\\n\\nThis patch moves back tcp_tw_isn to skb-\u003ecb[], getting rid of the per-cpu\\nvariable.\\n\\nNote that tcp_v{4,6}_fill_cb() do not set it.\\n\\nVery litle impact on overall code size/complexity:\\n\\n$ scripts/bloat-o-meter -t vmlinux.old vmlinux.new\\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7)\\nFunction                                     old     new   delta\\ntcp_v6_rcv                                  3038    3042      +4\\ntcp_v4_rcv                                  3035    3039      +4\\ntcp_conn_request                            2938    2923     -15\\nTotal: Before=24436060, After=24436053, chg -0.00%\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"include/net/tcp.h\",\"net/ipv4/tcp.c\",\"net/ipv4/tcp_input.c\",\"net/ipv4/tcp_ipv4.c\",\"net/ipv6/tcp_ipv6.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"41eecbd712b73f0d5dcf1152b9a1c27b1f238028\",\"lessThan\":\"e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41eecbd712b73f0d5dcf1152b9a1c27b1f238028\",\"lessThan\":\"4affe063fa56c880cbea8d0bfded0bb80751579d\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"41eecbd712b73f0d5dcf1152b9a1c27b1f238028\",\"lessThan\":\"1bbf0ced1d9db73ac7893c2187f3459288603e0d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"include/net/tcp.h\",\"net/ipv4/tcp.c\",\"net/ipv4/tcp_input.c\",\"net/ipv4/tcp_ipv4.c\",\"net/ipv6/tcp_ipv6.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"6.10\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"6.10\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.34\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.0.11\",\"lessThanOrEqual\":\"7.0.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H\",\"baseScore\":9.4,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.5}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/1bbf0ced1d9db73ac7893c2187f3459288603e0d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/4affe063fa56c880cbea8d0bfded0bb80751579d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-08-05T14:20:31+00:00",
      "cve": "CVE-2026-64024",
      "id": "CVE-2026-64024",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_affected": "198",
      "product_status:known_not_affected": "76",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64024.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-07-21T13:01:18Z",
      "cve": "CVE-2026-64024",
      "id": "CVE-2026-64024",
      "initial_release_date": "2026-07-21T13:01:18Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64024",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64024.json",
      "version": "2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.