ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-64024

tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

Published Jul 19, 2026 · catalog updated Oct 21, 2026 · tcp: fix stale per-CPU

Check if you run it

No confirmed exploitation is on record for CVE-2026-64024. EPSS is 0.31%. Act only if a listed version of tcp: fix stale per-CPU is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (tcp: fix stale per-CPU).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
Critical9.4
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.31%
Remediation
Advisory link
Affected products
Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the producer (__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer (tcp_conn_request()): - min_ttl / min_hopcount check - xfrm policy check - tcp_inbound_hash() MD5/AO mismatch - tcp_filter() eBPF/SO_ATTACH_FILTER drop - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv() - tcp_checksum_complete() in tcp_v{4,6}_do_rcv() - tcp_v{4,6}_cookie_check() returning NULL When a packet is dropped on any of these paths, tcp_tw_isn is left set. The next SYN processed on the same CPU then consumes the non zero value in tcp_conn_request(), receiving a potentially predictable ISN. This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu variable. Note that tcp_v{4,6}_fill_cb() do not set it. Very litle impact on overall code size/complexity: $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7) Function old new delta tcp_v6_rcv 3038 3042 +4 tcp_v4_rcv 3035 3039 +4 tcp_conn_request 2938 2923 -15 Total: Before=24436060, After=24436053, chg -0.00%

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Linux Kernel6.10.0 → 6.18.34; 6.19.0 → 7.0.11

How to fix CVE-2026-64024

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-64024. EPSS is 0.31%. Act only if a listed version of tcp: fix stale per-CPU is installed.

Which versions are affected?

Compare what you have installed with Kernel 6.10.0 → 6.18.34; 6.19.0 → 7.0.11. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.31%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 19, 2026 · OpenSSF OSV / OSV Scanner

    Detected

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the producer

  2. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 6.18.34; Kernel fixed in 7.0.11

  3. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 6.18.34; 6.19.0

  4. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the producer

Sources

References

Freshness

Last verified in this catalog Oct 23, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.