CVE-2026-64007
Received Received - Intake

Linux Kernel TCP Timestamp Option Write-after-Free

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain that pointer with skb_header_pointer() before calling in, so it may either alias skb->head directly or point at the caller's on-stack _tcph buffer. Between obtaining the pointer and using it, the function calls skb_ensure_writable(skb, optend), which on a cloned or non-linear skb invokes pskb_expand_head() and frees the old skb->head. After that point the cached th is stale: caller (ipv[46]_synproxy_hook) th = skb_header_pointer(skb, ..., &_tcph) synproxy_tstamp_adjust(skb, protoff, th, ...) skb_ensure_writable(skb, optend) pskb_expand_head() /* kfree(old skb->head) */ ... inet_proto_csum_replace4(&th->check, ...) /* writes into freed head, or into the caller's stack copy leaving the on-wire checksum stale */ The option bytes are written through skb->data and are fine; only the checksum update goes through th and so lands in the wrong place. The result is either a write into freed slab memory or a packet leaving with a checksum that does not match its payload. Fix by re-deriving th from skb->data + protoff immediately after skb_ensure_writable() succeeds, so the subsequent checksum update targets the linear, writable header.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64007
EUVD
EUVD-2026-45580

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a use-after-free issue in the synproxy component. It occurs when the TCP timestamp option is rewritten and the checksum is patched after the skb buffer is modified. The stale pointer leads to writing into freed memory or incorrect checksum updates, potentially causing crashes or packet corruption.

Detection Guidance

This vulnerability affects the Linux kernel's netfilter synproxy functionality. Detection requires checking if your system is running a vulnerable kernel version. Use commands like 'uname -a' to check the kernel version and compare it against patched versions. Monitor network traffic for checksum mismatches or crashes in synproxy-related processes.

Impact Analysis

This vulnerability could allow attackers to cause system crashes or execute arbitrary code with kernel privileges. It may also lead to network packet corruption or denial-of-service conditions on affected systems running vulnerable Linux kernel versions.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel networking issue that could lead to packet corruption or memory corruption rather than data privacy or security violations.

Mitigation Strategies

Immediately update your Linux kernel to the latest patched version. If updating is not immediately possible, disable the synproxy module using 'modprobe -r nf_synproxy_core' or adjust firewall rules to avoid using synproxy features until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64007. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart