CVE-2026-64422

Analyzed Analyzed - Analysis Complete

Integer Overflow in Linux Kernel TCP Reordering

Publication date: 2026-07-25

Last updated on: 2026-09-08

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid `net.ipv4.tcp_reordering` values before they reach TCP socket state. The sysctl is stored as an `int` but copied into the `u32` `tp->reordering` field for new sockets, so negative writes wrap to large values. With `tcp_mtu_probing=2`, the wrapped value can overflow the `tcp_mtu_probe()` size calculation and drive the MTU probing path into an out-of-bounds read. Route `tcp_reordering` writes through `proc_dointvec_minmax()` and require it to be at least 1. Also require `tcp_max_reordering` to be at least 1 so the configured maximum cannot become negative either. When registering the table for a non-init network namespace, relocate `extra2` pointers that refer into `init_net.ipv4` so the `tcp_reordering` upper bound follows that namespace's `tcp_max_reordering`. Harden `tcp_mtu_probe()` itself by computing `size_needed` as `u64`. This keeps the send queue and window checks from being bypassed through signed integer overflow.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-09-08

Generated

2026-09-23

AI Q&A

2026-07-25

EPSS Evaluated

2026-09-22

NVD

CVE-2026-64422

EUVD

EUVD-2026-48966

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	2.6.24
linux	linux_kernel	2.6.24
linux	linux_kernel	2.6.24
linux	linux_kernel	2.6.24
linux	linux_kernel	2.6.24
linux	linux_kernel	2.6.24
linux	linux_kernel	From 5.11 (inc) to 5.15.212 (exc)
linux	linux_kernel	From 5.16 (inc) to 6.1.178 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.145 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.96 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.39 (exc)
linux	linux_kernel	From 6.19 (inc) to 7.1.4 (exc)
linux	linux_kernel	From 2.6.24.1 (inc) to 5.10.261 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-190	The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves improper handling of the TCP reordering sysctl value. When negative values are written to net.ipv4.tcp_reordering, they wrap to large positive values due to type conversion from int to u32. This can cause issues in the TCP MTU probing mechanism, leading to out-of-bounds memory reads.

Detection Guidance

This vulnerability involves improper handling of the tcp_reordering sysctl parameter in the Linux kernel. Detection requires checking kernel parameters and network stack behavior. Inspect the current tcp_reordering value using: sysctl net.ipv4.tcp_reordering. If it is negative or set to an unusually high value, it may indicate exposure. Monitor for MTU probing issues or out-of-bounds reads in kernel logs. Check if tcp_mtu_probing is set to 2 using: sysctl net.ipv4.tcp_mtu_probing.

Impact Analysis

An attacker could exploit this to cause a denial of service or potentially execute arbitrary code on affected systems by triggering the out-of-bounds read. Systems using tcp_mtu_probing=2 are particularly vulnerable.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it pertains to a Linux kernel TCP networking issue rather than data protection or privacy controls.

Mitigation Strategies

Immediately update the Linux kernel to the latest patched version to resolve the issue. Set tcp_reordering to a valid positive value (minimum 1) using: sysctl -w net.ipv4.tcp_reordering=3. Ensure tcp_max_reordering is also at least 1: sysctl -w net.ipv4.tcp_max_reordering=100. Disable tcp_mtu_probing if not required: sysctl -w net.ipv4.tcp_mtu_probing=0. Apply these changes persistently by editing /etc/sysctl.conf.

Hi! I’m here to help you understand CVE-2026-64422. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70