{"id":"CVE-2026-64024","title":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction\n\nBlamed commit moved the TIME_WAIT-derived ISN from the skb control\nblock to a per-CPU variable, assuming…","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction\n\nBlamed commit moved the TIME_WAIT-derived ISN from the skb control\nblock to a per-CPU variable, assuming…","severity":"critical","cvss":9.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","cwe":["CWE-401","CWE-342"],"vendor":"linux","product":"linux_kernel","affected":["linux_kernel >= 6.10, < 6.18.34","linux_kernel >= 6.19, < 7.0.11","linux_kernel = 7.1"],"patched":["linux_kernel 7.0.11"],"published":"2026-07-19","updated":"2026-10-13","sourceUpdated":"2026-10-13T15:00:30.167","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-64024","references":[{"url":"https://git.kernel.org/stable/c/1bbf0ced1d9db73ac7893c2187f3459288603e0d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/4affe063fa56c880cbea8d0bfded0bb80751579d","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://git.kernel.org/stable/c/e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd","label":"416baaa9-dc9f-4396-8d5f-8c081fb06d67"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64024.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-64024"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2502333"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-64024"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64024"},{"url":"https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-64024-8c76@gregkh/T"},{"url":"https://access.redhat.com/errata/RHSA-2026:86033"},{"url":"https://git.kernel.org/stable/c/8bb6aa419b142dcc2680177ecc39c4c38db7fc16"},{"url":"https://access.redhat.com/errata/RHSA-2026:76738"}],"tags":["nvd","cve.org","csaf","vex","red-hat","score-dispute"],"epss":0.00308,"epssPercentile":0.23441,"ingestedAt":"2026-10-13T15:33:40.025Z","ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-10-16T15:35:24.819208Z"},"scores":{"nvd":9.4,"vendor":7,"cna":9.4},"slug":"CVE-2026-64024","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction\n\nBlamed commit moved the TIME_WAIT-derived ISN from the skb control\nblock to a per-CPU variable, assuming the value would always be consumed\nby tcp_conn_request() for the same packet that wrote it. That assumption\nis violated by multiple drop paths between the producer\n(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer\n(tcp_conn_request()):\n\n - min_ttl / min_hopcount check\n - xfrm policy check\n - tcp_inbound_hash() MD5/AO mismatch\n - tcp_filter() eBPF/SO_ATTACH_FILTER drop\n - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN\n - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()\n - tcp_checksum_complete() in tcp_v{4,6}_do_rcv()\n - tcp_v{4,6}_cookie_check() returning NULL\n\nWhen a packet is dropped on any of these paths, tcp_tw_isn is left set.\n\nThe next SYN processed on the same CPU then consumes the non zero value in\ntcp_conn_request(), receiving a potentially predictable ISN.\n\nThis patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu\nvariable.\n\nNote that tcp_v{4,6}_fill_cb() do not set it.\n\nVery litle impact on overall code size/complexity:\n\n$ scripts/bloat-o-meter -t vmlinux.old vmlinux.new\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7)\nFunction                                     old     new   delta\ntcp_v6_rcv                                  3038    3042      +4\ntcp_v4_rcv                                  3035    3039      +4\ntcp_conn_request                            2938    2923     -15\nTotal: Before=24436060, After=24436053, chg -0.00%\n\n## Affected\n\n- `linux_kernel >= 6.10, < 6.18.34`\n- `linux_kernel >= 6.19, < 7.0.11`\n- `linux_kernel = 7.1`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `linux_kernel 7.0.11`\n\n## Vendor advisories\n\n- **RHSA-2026:86033** · Red Hat · fixed in: Red Hat Enterprise Linux AppStream (v. 9), Red Hat Enterprise Linux BaseOS (v. 9), Red Hat Enterprise Linux CodeReady Linux Builder (v. 9), Red Hat Enterprise Linux Real Time for NFV (v. 9), Red Hat Enterprise Linux Real Time (v. 9) · released 2026-10-20 · [advisory](https://access.redhat.com/errata/RHSA-2026:86033)\n- **Red Hat VEX** · Moderate · affected: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9 · no fix planned: Red Hat Enterprise Linux 6, Red Hat Enterprise Linux 9 · updated 2026-10-26 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64024.json)\n- **RHSA-2026:76738** · Red Hat · fixed in: 10Base-SMTV, Red Hat Enterprise Linux AppStream (v. 10), Red Hat Enterprise Linux BaseOS (v. 10), Red Hat Enterprise Linux CodeReady Linux Builder (v. 10), Red Hat Enterprise Linux Hidden (v. 10), Red Hat Enterprise Linux Real Time for NFV (v. 10), … · released 2026-10-08 · [advisory](https://access.redhat.com/errata/RHSA-2026:76738)","depth":"midnight","depthScore":52,"depthScoreParts":{"impact":51.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}