CVE-2026-64024 - Vulnerability Details

- tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

Blamed commit moved the TIME_WAIT-derived ISN from the skb control
block to a per-CPU variable, assuming the value would always be consumed
by tcp_conn_request() for the same packet that wrote it. That assumption
is violated by multiple drop paths between the producer
(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer
(tcp_conn_request()):

- min_ttl / min_hopcount check
- xfrm policy check
- tcp_inbound_hash() MD5/AO mismatch
- tcp_filter() eBPF/SO_ATTACH_FILTER drop
- th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN
- psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()
- tcp_checksum_complete() in tcp_v{4,6}_do_rcv()
- tcp_v{4,6}_cookie_check() returning NULL

When a packet is dropped on any of these paths, tcp_tw_isn is left set.

The next SYN processed on the same CPU then consumes the non zero value in
tcp_conn_request(), receiving a potentially predictable ISN.

This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu
variable.

Note that tcp_v{4,6}_fill_cb() do not set it.

Very litle impact on overall code size/complexity:

$ scripts/bloat-o-meter -t vmlinux.old vmlinux.new
add/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7)
Function old new delta
tcp_v6_rcv 3038 3042 +4
tcp_v4_rcv 3035 3039 +4
tcp_conn_request 2938 2923 -15
Total: Before=24436060, After=24436053, chg -0.00%

Published: 2026-07-19

Score: 9.4 Critical

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability occurs when a stale per‑CPU variable storing a TCP TIME_WAIT‑derived Initial Sequence Number (ISN) is left set after a packet is dropped in various kernel drop paths. The next SYN handled by the same CPU consumes this non‑zero value, making the ISN predictable. An attacker that can observe or guess the sequence number can hijack a TCP session or inject traffic, compromising confidentiality and integrity. This flaw corresponds to CWE-342: Stale Release of Sensitive Information.

Affected Systems

Linux kernel builds that contain the legacy per‑CPU tcp_tw_isn implementation, i.e. all kernel versions released before the patch commit that moved tcp_tw_isn back into the skb control block. The fix applies to all branches of the official Linux kernel.

Risk and Exploitability

With a CVSS score of 9.4 the vulnerability is considered critical. The EPSS score is reported as less than 1%, indicating a very low but non‑zero likelihood of exploitation in the wild. Because ISN prediction can be performed remotely by sending crafted SYN packets to a target machine running the vulnerable kernel, the attack vector is inferred to be remote network access. The vulnerability is not listed in the CISA KEV catalog, so no known ESoT exploits have been documented yet.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`41eecbd712b73f0d5dcf1152b9a1c27b1f238028`	affected	< e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd
`41eecbd712b73f0d5dcf1152b9a1c27b1f238028`	affected	< 4affe063fa56c880cbea8d0bfded0bb80751579d
`41eecbd712b73f0d5dcf1152b9a1c27b1f238028`	affected	< 1bbf0ced1d9db73ac7893c2187f3459288603e0d

Linux

affected

Version	Status	Constraints
`6.10`	affected	—
`0`	unaffected	< 6.10
`6.18.34`	unaffected	≤ 6.18.*
`7.0.11`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[41eecbd712b73f0d5dcf1152b9a1c27b1f238028,e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd)`	affected	code_commit	—
`[41eecbd712b73f0d5dcf1152b9a1c27b1f238028,4affe063fa56c880cbea8d0bfded0bb80751579d)`	affected	code_commit	—
`[41eecbd712b73f0d5dcf1152b9a1c27b1f238028,1bbf0ced1d9db73ac7893c2187f3459288603e0d)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.10`	affected	generic	—
`[0,6.10)`	unaffected	generic	—
`[6.18.34,6.19.0)`	unaffected	semver	—
`[7.0.11,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply an updated Linux kernel that incorporates the fixed implementation of tcp_tw_isn and reboot into it.
If immediate kernel upgrade is not feasible, apply a vendor‑provided backport or patch to the current kernel and rebuild.
Add firewall or IDS rules that detect and mitigate suspicious SYN traffic, such as limiting inbound SYN rate from external hosts.

Generated by OpenCVE AI on August 4, 2026 at 18:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8593-1	Linux kernel vulnerabilities
Ubuntu USN	USN-8603-1	Linux kernel (Azure) vulnerabilities
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00385.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/1bbf0ced1d9db73ac7893c2187f3459288603e0d
https://git.kernel.org/stable/c/4affe063fa56c880cbea8d0bfded0bb80751579d
https://git.kernel.org/stable/c/e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd
https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-64024-8c76@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64024
https://www.cve.org/CVERecord?id=CVE-2026-64024

History

Wed, 22 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-342
References		https://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-64024-8c76@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64024 https://www.cve.org/CVERecord?id=CVE-2026-64024
Metrics	threat_severity `None`	threat_severity `Moderate`

Mon, 20 Jul 2026 14:45:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 9.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H'}`

Sun, 19 Jul 2026 15:45:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the producer (__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer (tcp_conn_request()): - min_ttl / min_hopcount check - xfrm policy check - tcp_inbound_hash() MD5/AO mismatch - tcp_filter() eBPF/SO_ATTACH_FILTER drop - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv() - tcp_checksum_complete() in tcp_v{4,6}_do_rcv() - tcp_v{4,6}_cookie_check() returning NULL When a packet is dropped on any of these paths, tcp_tw_isn is left set. The next SYN processed on the same CPU then consumes the non zero value in tcp_conn_request(), receiving a potentially predictable ISN. This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu variable. Note that tcp_v{4,6}_fill_cb() do not set it. Very litle impact on overall code size/complexity: $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7) Function old new delta tcp_v6_rcv 3038 3042 +4 tcp_v4_rcv 3035 3039 +4 tcp_conn_request 2938 2923 -15 Total: Before=24436060, After=24436053, chg -0.00%
Title		tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/1bbf0ced1d9db73ac7893c2187f3459288603e0d https://git.kernel.org/stable/c/4affe063fa56c880cbea8d0bfded0bb80751579d https://git.kernel.org/stable/c/e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-19T15:39:16.598Z

Updated: 2026-08-05T12:38:18.798Z

Reserved: 2026-07-19T07:54:57.027Z

Link: CVE-2026-64024

Vulnrichment

No data.

NVD

No data.

Redhat

Severity : Moderate

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64024 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-04T18:15:03Z

Weaknesses

CWE-342
Predictable Exact Value from Previous Values

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object