In the Linux kernel, a defect allowed extremely old or future TCP ACK packets to bypass the usual validation checks when they were handled by the fast path. ACKs received before the sender’s oldest unacknowledged sequence number (SND.UNA) or after the next expected sequence number (SND.NXT) could be accepted and used to advance the receiver’s next sequence number (RCV.NXT) without proper scrutiny. The fix redirects such packets to the slower, fully validated path, preventing malicious or erroneous manipulation of TCP connection state. This weakness corresponds to CWE-358.

The flaw applies to any Linux kernel that had not yet integrated the patch. No version range is explicitly listed, so all kernel builds prior to the fix are potentially affected.

An attacker could send crafted ACK packets over the network to alter TCP connection state or cause service disruption. The CVSS score of 7.0 indicates high severity, while the EPSS score of 0.00184 indicates a very low exploitation probability. Yet the vulnerability permits direct manipulation of TCP control flow, although it is not listed in the CISA KEV catalog. The likely attack vector is network-based packet injection, inferred from the nature of the bug.