The Linux kernel change that re‑introduced TCP source port values into secure‑sequence number randomization unintentionally enables an off‑path attacker to recover the client’s source port via a timing side‑channel on the SYN‑cookie response. By measuring slight differences in the time it takes for the kernel to generate the SYN‑cookie and its accompanying timestamp offset, the attacker can infer the original source port. This information can help bypass port‑based filtering, enable more targeted scans, and serve as a foothold for further network attacks. The flaw does not provide direct code execution or memory corruption; it merely leaks data.

All Linux kernel builds that contain the commit that removed per‑host port data from the secure‑sequence number calculation (identified by commit 28ee1b746f49) and have not yet applied the revert that restores that data are vulnerable. In practice this covers every distribution that shipped a kernel version before the revert was merged. The affected product is simply the "Linux kernel" across all vendors that ship it.

The CVSS base score of 5.5 indicates a moderate severity, and the EPSS score of less than 1 % suggests a low overall probability of exploitation. The attack requires an off‑path observer with precise timing capabilities to measure SYN‑cookie response times, a condition that limits the attack surface but still makes the disclosed information valuable. The vulnerability is not listed in the CISA KEV catalog, but because the leaked data can aid in port‑scanning and threat propagation, administrators should consider it a high‑priority defensive requirement for systems exposed to the Internet.