CVE-2026-64422
Received Received - Intake

BaseFortify

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid `net.ipv4.tcp_reordering` values before they reach TCP socket state. The sysctl is stored as an `int` but copied into the `u32` `tp->reordering` field for new sockets, so negative writes wrap to large values. With `tcp_mtu_probing=2`, the wrapped value can overflow the `tcp_mtu_probe()` size calculation and drive the MTU probing path into an out-of-bounds read. Route `tcp_reordering` writes through `proc_dointvec_minmax()` and require it to be at least 1. Also require `tcp_max_reordering` to be at least 1 so the configured maximum cannot become negative either. When registering the table for a non-init network namespace, relocate `extra2` pointers that refer into `init_net.ipv4` so the `tcp_reordering` upper bound follows that namespace's `tcp_max_reordering`. Harden `tcp_mtu_probe()` itself by computing `size_needed` as `u64`. This keeps the send queue and window checks from being bypassed through signed integer overflow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64422
EUVD
EUVD-2026-48966

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel to 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of the TCP reordering sysctl value. When negative values are written to net.ipv4.tcp_reordering, they wrap to large positive values due to type conversion from int to u32. This can cause issues in the TCP MTU probing mechanism, leading to out-of-bounds memory reads.

Detection Guidance

This vulnerability involves improper handling of the tcp_reordering sysctl parameter in the Linux kernel. Detection requires checking kernel parameters and network stack behavior. Inspect the current tcp_reordering value using: sysctl net.ipv4.tcp_reordering. If it is negative or set to an unusually high value, it may indicate exposure. Monitor for MTU probing issues or out-of-bounds reads in kernel logs. Check if tcp_mtu_probing is set to 2 using: sysctl net.ipv4.tcp_mtu_probing.

Impact Analysis

An attacker could exploit this to cause a denial of service or potentially execute arbitrary code on affected systems by triggering the out-of-bounds read. Systems using tcp_mtu_probing=2 are particularly vulnerable.

Mitigation Strategies

Immediately update the Linux kernel to the latest patched version to resolve the issue. Set tcp_reordering to a valid positive value (minimum 1) using: sysctl -w net.ipv4.tcp_reordering=3. Ensure tcp_max_reordering is also at least 1: sysctl -w net.ipv4.tcp_max_reordering=100. Disable tcp_mtu_probing if not required: sysctl -w net.ipv4.tcp_mtu_probing=0. Apply these changes persistently by editing /etc/sysctl.conf.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64422. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart