CVE-2026-64024
Received Received - Intake

Linux kernel TCP ISN prediction vulnerability fix

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the producer (__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer (tcp_conn_request()): - min_ttl / min_hopcount check - xfrm policy check - tcp_inbound_hash() MD5/AO mismatch - tcp_filter() eBPF/SO_ATTACH_FILTER drop - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv() - tcp_checksum_complete() in tcp_v{4,6}_do_rcv() - tcp_v{4,6}_cookie_check() returning NULL When a packet is dropped on any of these paths, tcp_tw_isn is left set. The next SYN processed on the same CPU then consumes the non zero value in tcp_conn_request(), receiving a potentially predictable ISN. This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu variable. Note that tcp_v{4,6}_fill_cb() do not set it. Very litle impact on overall code size/complexity: $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7) Function old new delta tcp_v6_rcv 3038 3042 +4 tcp_v4_rcv 3035 3039 +4 tcp_conn_request 2938 2923 -15 Total: Before=24436060, After=24436053, chg -0.00%

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64024
EUVD
EUVD-2026-45597

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in how TCP Initial Sequence Numbers (ISNs) are generated for new connections. A change moved ISN generation from a shared control block to a per-CPU variable, assuming it would always be used immediately. However, certain packet drops during processing leave the per-CPU variable set with a stale value. The next SYN packet processed on that CPU then uses this stale value, potentially making ISNs predictable and weakening security.

Detection Guidance

This vulnerability is specific to the Linux kernel's TCP implementation and may not have direct detection commands. However, monitoring for unusual ISN (Initial Sequence Number) patterns in TCP connections could indicate exploitation. Check kernel logs for tcp_tw_isn-related errors or anomalies in TCP connection handling.

Impact Analysis

This vulnerability could allow an attacker to predict TCP ISNs, which might enable session hijacking or other network-based attacks. If successful, an attacker could intercept or manipulate communications between systems, potentially leading to data breaches or unauthorized access.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It involves a predictable TCP Initial Sequence Number (ISN) due to a kernel flaw, which could theoretically enable session hijacking or spoofing. However, no evidence suggests direct impacts on data protection or privacy compliance requirements.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Update your system to a kernel version that includes the fix for the tcp_tw_isn leak. Monitor vendor advisories for updates if you are using a distribution-specific kernel.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64024. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart