CVE-2026-64007 - Vulnerability Details

- netfilter: synproxy: refresh tcphdr after skb_ensure_writable

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: synproxy: refresh tcphdr after skb_ensure_writable

synproxy_tstamp_adjust() rewrites the TCP timestamp option in place
and then patches the TCP checksum via inet_proto_csum_replace4() on
the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and
ipv6_synproxy_hook() obtain that pointer with skb_header_pointer()
before calling in, so it may either alias skb->head directly or
point at the caller's on-stack _tcph buffer.

Between obtaining the pointer and using it, the function calls
skb_ensure_writable(skb, optend), which on a cloned or non-linear
skb invokes pskb_expand_head() and frees the old skb->head. After
that point the cached th is stale:

caller (ipv[46]_synproxy_hook)
th = skb_header_pointer(skb, ..., &_tcph)
synproxy_tstamp_adjust(skb, protoff, th, ...)
skb_ensure_writable(skb, optend)
pskb_expand_head() /* kfree(old skb->head) */
...
inet_proto_csum_replace4(&th->check, ...)
/* writes into freed head, or
into the caller's stack copy
leaving the on-wire checksum
stale */

The option bytes are written through skb->data and are fine; only
the checksum update goes through th and so lands in the wrong
place. The result is either a write into freed slab memory or a
packet leaving with a checksum that does not match its payload.

Fix by re-deriving th from skb->data + protoff immediately after
skb_ensure_writable() succeeds, so the subsequent checksum update
targets the linear, writable header.

Published: 2026-07-19

Score: 9.8 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The bug resides in the Linux kernel’s netfilter SYNPROXY code. It rewrites the TCP timestamp option in place and then updates the TCP checksum using a pointer obtained before the packet buffer is made writable. Between obtaining that pointer and using it, the buffer is expanded, freeing the original header space. The checksum update therefore writes into freed memory or modifies a stale header, causing a use‑after‑free fault. This can lead to an kernel Oops or crash, and in some scenarios may provide a vector for remote code execution, although the description does not confirm a reliable execution path. The underlying weakness is memory corruption (CWE‑825) and use‑after‑free (CWE‑416).

Affected Systems

All Linux kernel releases that include the netfilter SYNPROXY component for IPv4 and IPv6 are affected. Any kernel version prior to the commit 92170e6afe927ab that implements the fix is vulnerable, regardless of distribution vendor.

Risk and Exploitability

The vulnerability has a CVSS score of 9.8, indicating a high impact on confidentiality, integrity and availability. Its EPSS score of less than 1% indicates that exploitation is currently very uncommon, and it is not listed in CISA’s KEV catalog. The vulnerable code triggers a use‑after‑free and memory corruption, allowing an attacker to send specially crafted SYN packets to a host running SYNPROXY. This can cause a kernel crash or, at best, provide a speculative code‑execution route.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`48b1de4c110a7afa4b85862f6c75af817db26fad`	affected	< 9902a1058992de5d95656b64a3bd95c077f7ba2c
`48b1de4c110a7afa4b85862f6c75af817db26fad`	affected	< d3019c61799adc21811af4b521f11f3dc77f8e04
`48b1de4c110a7afa4b85862f6c75af817db26fad`	affected	< dd206819f210522579010d889d45a9530bb494bc
`48b1de4c110a7afa4b85862f6c75af817db26fad`	affected	< af2c22ccb1f621aff487ff47a040e38e058541e7
`48b1de4c110a7afa4b85862f6c75af817db26fad`	affected	< c7f945f7da097245a2f8ed7775ce48421047ee96
`48b1de4c110a7afa4b85862f6c75af817db26fad`	affected	< f0fea2b6d5453a11ad11713bbf37561b9b3a7edf
`48b1de4c110a7afa4b85862f6c75af817db26fad`	affected	< a91887a5b6ee4b98dfbf1db657ed2b879430149e
`48b1de4c110a7afa4b85862f6c75af817db26fad`	affected	< 92170e6afe927ab2792a3f71902845789c8e31b1

Linux

affected

Version	Status	Constraints
`3.12`	affected	—
`0`	unaffected	< 3.12
`5.10.259`	unaffected	≤ 5.10.*
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc4::::::
	cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[48b1de4c110a7afa4b85862f6c75af817db26fad,9902a1058992de5d95656b64a3bd95c077f7ba2c)`	affected	code_commit	—
`[48b1de4c110a7afa4b85862f6c75af817db26fad,d3019c61799adc21811af4b521f11f3dc77f8e04)`	affected	code_commit	—
`[48b1de4c110a7afa4b85862f6c75af817db26fad,dd206819f210522579010d889d45a9530bb494bc)`	affected	code_commit	—
`[48b1de4c110a7afa4b85862f6c75af817db26fad,af2c22ccb1f621aff487ff47a040e38e058541e7)`	affected	code_commit	—
`[48b1de4c110a7afa4b85862f6c75af817db26fad,c7f945f7da097245a2f8ed7775ce48421047ee96)`	affected	code_commit	—
`[48b1de4c110a7afa4b85862f6c75af817db26fad,f0fea2b6d5453a11ad11713bbf37561b9b3a7edf)`	affected	code_commit	—
`[48b1de4c110a7afa4b85862f6c75af817db26fad,a91887a5b6ee4b98dfbf1db657ed2b879430149e)`	affected	code_commit	—
`[48b1de4c110a7afa4b85862f6c75af817db26fad,92170e6afe927ab2792a3f71902845789c8e31b1)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`3.12`	affected	generic	—
`[0,3.12)`	unaffected	generic	—
`[5.10.259,5.11.0]`	unaffected	semver	—
`[5.15.210,5.16.0]`	unaffected	semver	—
`[6.1.176,6.2.0]`	unaffected	semver	—
`[6.6.143,6.7.0]`	unaffected	semver	—
`[6.12.93,6.13.0]`	unaffected	semver	—
`[6.18.35,6.19.0]`	unaffected	semver	—
`[7.0.12,7.1.0]`	unaffected	semver	—
`[0,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

Apply the latest kernel update that includes the SYNPROXY timestamp adjustment fix from commit 92170e6afe927ab.
If an immediate update is not possible, disable SYNPROXY by removing or flushing all firewall rules that use the SYNPROXY target and ensure that no inbound traffic is processed by SYNPROXY.
After patching or disabling SYNPROXY, monitor kernel logs for Oops or crash messages to confirm that the issue has been mitigated.

Generated by OpenCVE AI on October 17, 2026 at 10:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8663-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8664-1	Linux kernel (NVIDIA BaseOS) vulnerabilities
Ubuntu USN	USN-8728-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8781-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8728-2	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8817-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8818-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8818-2	Linux kernel (IBM) vulnerabilities
Ubuntu USN	USN-8728-3	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8842-1	Linux kernel (NVIDIA) vulnerabilities
Ubuntu USN	USN-8818-3	Linux kernel vulnerabilities
Ubuntu USN	USN-8818-4	Linux kernel vulnerabilities
Ubuntu USN	USN-8849-1	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8817-3	Linux kernel (AWS) vulnerabilities
Ubuntu USN	USN-8818-5	Linux kernel (NVIDIA Tegra) vulnerabilities
Ubuntu USN	USN-8871-1	Linux kernel (Raspberry Pi) vulnerabilities
Ubuntu USN	USN-8878-1	Linux kernel (GCP) vulnerabilities
Ubuntu USN	USN-8879-1	Linux kernel (Oracle) vulnerabilities
Ubuntu USN	USN-8906-1	Linux kernel (IBM) vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00514.

Exploitation none

Automatable yes

Technical Impact total

References

Link	Providers
https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1
https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c
https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e
https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7
https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96
https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04
https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc
https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf
https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-64007-5e61@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64007
https://www.cve.org/CVERecord?id=CVE-2026-64007

History

Fri, 16 Oct 2026 17:30:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Tue, 13 Oct 2026 14:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416
CPEs		cpe:2.3:o:linux:linux_kernel:7.1:rc1:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc2:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc3:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc4:::::: cpe:2.3:o:linux:linux_kernel:7.1:rc5::::::

Sun, 26 Jul 2026 08:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-416

Wed, 22 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-416

Wed, 22 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-825
References		https://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-64007-5e61@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64007 https://www.cve.org/CVERecord?id=CVE-2026-64007
Metrics	threat_severity `None`	threat_severity `Important`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Sun, 19 Jul 2026 15:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain that pointer with skb_header_pointer() before calling in, so it may either alias skb->head directly or point at the caller's on-stack _tcph buffer. Between obtaining the pointer and using it, the function calls skb_ensure_writable(skb, optend), which on a cloned or non-linear skb invokes pskb_expand_head() and frees the old skb->head. After that point the cached th is stale: caller (ipv[46]_synproxy_hook) th = skb_header_pointer(skb, ..., &_tcph) synproxy_tstamp_adjust(skb, protoff, th, ...) skb_ensure_writable(skb, optend) pskb_expand_head() /* kfree(old skb->head) / ... inet_proto_csum_replace4(&th->check, ...) / writes into freed head, or into the caller's stack copy leaving the on-wire checksum stale */ The option bytes are written through skb->data and are fine; only the checksum update goes through th and so lands in the wrong place. The result is either a write into freed slab memory or a packet leaving with a checksum that does not match its payload. Fix by re-deriving th from skb->data + protoff immediately after skb_ensure_writable() succeeds, so the subsequent checksum update targets the linear, writable header.
Title		netfilter: synproxy: refresh tcphdr after skb_ensure_writable
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1 https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7 https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96 https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04 https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T14:56:23.049Z

Updated: 2026-10-19T20:28:08.086Z

Reserved: 2026-07-19T07:54:57.026Z

Link: CVE-2026-64007

Vulnrichment

Updated: 2026-10-16T15:35:13.508Z

NVD

Status : Modified

Published: 2026-07-19T16:17:40.407

Modified: 2026-10-19T21:17:18.750

Link: CVE-2026-64007

Redhat

Severity : Important

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64007 - Bugzilla

OpenCVE Enrichment

Updated: 2026-10-17T10:15:07Z

Weaknesses

CWE-416
Use After Free
CWE-825
Expired Pointer Dereference

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable yes

Technical Impact total

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object