CVE-2026-23247None▾ Sunlit

tcp: secure_seq: add back ports to TS offset

In the Linux kernel, the following vulnerability has been resolved: tcp: secure_seq: add back ports to TS offset This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets") tcp_tw_recycle went away in 2017. Zhou…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 18, 2026

Updated

Oct 21, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

0.17% · p6

Platforms

—

Source

CVEORG

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Oct 21.

0.1% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 222 days

Mar 18, 2026Published
Disclosed via CVEORG
Oct 21, 2026Record revised
Last analysed / modified upstream
Oct 21, 2026EPSS first tracked
0.1%
Oct 26, 2026EPSS peak
0.1% → 0.2%

Linux #cve.org

Affected

Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < e873e8c16b2fb743a381a9e59c108e63512301ec
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 5da5662181ef8a251e3ba564903002c2e87de452
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < eae2f14ab2efccdb7480fae7d42c4b0116ef8805
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 46e5b0d7cf55821527adea471ffe52a5afbd9caf
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 165573e41f2f66ef98940cf65f838b2cb575d9d1
Linux 443fac9f2618b93cbc5ab068dc594530236b3a23
Linux >= 4.10.14 < 4.11
Linux 4.11

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

tcp: secure_seq: add back ports to TS offset

This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets")

tcp_tw_recycle went away in 2017.

Zhouyan Deng reported off-path TCP source port leakage via SYN cookie side-channel that can be fixed in multiple ways.

One of them is to bring back TCP ports in TS offset randomization.

As a bonus, we perform a single siphash() computation to provide both an ISN and a TS offset.

Affected

Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < e873e8c16b2fb743a381a9e59c108e63512301ec
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 5da5662181ef8a251e3ba564903002c2e87de452
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < eae2f14ab2efccdb7480fae7d42c4b0116ef8805
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 46e5b0d7cf55821527adea471ffe52a5afbd9caf
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 165573e41f2f66ef98940cf65f838b2cb575d9d1
Linux 443fac9f2618b93cbc5ab068dc594530236b3a23
Linux >= 4.10.14 < 4.11
Linux 4.11

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

← Back to feed

CVE-2026-23247None▾ Sunlit

tcp: secure_seq: add back ports to TS offset

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Mar 18, 2026

Updated

Oct 21, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

0.17% · p6

Platforms

—

Source

CVEORG

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Oct 21.

0.1% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 222 days

Mar 18, 2026Published
Disclosed via CVEORG
Oct 21, 2026Record revised
Last analysed / modified upstream
Oct 21, 2026EPSS first tracked
0.1%
Oct 26, 2026EPSS peak
0.1% → 0.2%

Linux #cve.org

Affected

Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < e873e8c16b2fb743a381a9e59c108e63512301ec
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 5da5662181ef8a251e3ba564903002c2e87de452
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < eae2f14ab2efccdb7480fae7d42c4b0116ef8805
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 46e5b0d7cf55821527adea471ffe52a5afbd9caf
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 165573e41f2f66ef98940cf65f838b2cb575d9d1
Linux 443fac9f2618b93cbc5ab068dc594530236b3a23
Linux >= 4.10.14 < 4.11
Linux 4.11

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

tcp: secure_seq: add back ports to TS offset

This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets")

tcp_tw_recycle went away in 2017.

Zhouyan Deng reported off-path TCP source port leakage via SYN cookie side-channel that can be fixed in multiple ways.

One of them is to bring back TCP ports in TS offset randomization.

As a bonus, we perform a single siphash() computation to provide both an ISN and a TS offset.

Affected

Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < e873e8c16b2fb743a381a9e59c108e63512301ec
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 5da5662181ef8a251e3ba564903002c2e87de452
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < eae2f14ab2efccdb7480fae7d42c4b0116ef8805
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 46e5b0d7cf55821527adea471ffe52a5afbd9caf
Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 165573e41f2f66ef98940cf65f838b2cb575d9d1
Linux 443fac9f2618b93cbc5ab068dc594530236b3a23
Linux >= 4.10.14 < 4.11
Linux 4.11

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org