CVE-2026-64024

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64024", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.027Z", "datePublished": "2026-07-19T15:39:16.598Z", "dateUpdated": "2026-10-21T12:42:55.876Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:42:55.876Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction\n\nBlamed commit moved the TIME_WAIT-derived ISN from the skb control\nblock to a per-CPU variable, assuming the value would always be consumed\nby tcp_conn_request() for the same packet that wrote it. That assumption\nis violated by multiple drop paths between the producer\n(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer\n(tcp_conn_request()):\n\n - min_ttl / min_hopcount check\n - xfrm policy check\n - tcp_inbound_hash() MD5/AO mismatch\n - tcp_filter() eBPF/SO_ATTACH_FILTER drop\n - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN\n - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()\n - tcp_checksum_complete() in tcp_v{4,6}_do_rcv()\n - tcp_v{4,6}_cookie_check() returning NULL\n\nWhen a packet is dropped on any of these paths, tcp_tw_isn is left set.\n\nThe next SYN processed on the same CPU then consumes the non zero value in\ntcp_conn_request(), receiving a potentially predictable ISN.\n\nThis patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu\nvariable.\n\nNote that tcp_v{4,6}_fill_cb() do not set it.\n\nVery litle impact on overall code size/complexity:\n\n$ scripts/bloat-o-meter -t vmlinux.old vmlinux.new\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7)\nFunction old new delta\ntcp_v6_rcv 3038 3042 +4\ntcp_v4_rcv 3035 3039 +4\ntcp_conn_request 2938 2923 -15\nTotal: Before=24436060, After=24436053, chg -0.00%"}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "baseScore": 9.4, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is reached from the standard IPv4/IPv6 TCP receive path (tcp_v4_rcv/tcp_v6_rcv) when remote attackers send crafted TCP packets to any listening service on the host.\nAC:L - An attacker fully controls the trigger sequence\u2014establishing TIME_WAIT state, deliberately causing drops on documented paths (e.g., SYN+FIN or checksum failure), and spraying SYNs to land on the same CPU via RPS flow hashing\u2014without depending on uncontrollable timing or memory layout.\nPR:N - Exploitation requires only the ability to send TCP packets to a reachable port; no local shell access, capabilities, or authentication is needed on the target system.\nUI:N - No victim user action is required; the attack is conducted entirely by sending network packets to an internet-facing or LAN-reachable server.\nS:U - Impact is confined to the kernel TCP stack on the target host (predictable ISNs, syncookie bypass, session manipulation) and does not cross a VM, container, or IOMMU security boundary.\nC:L - Stale TIME_WAIT ISNs leak predictable sequence-number information that an off-path attacker can use to infer or intercept data on affected TCP connections, bypassing the cryptographically generated ISNs from secure_tcp_seq_and_ts_off().\nI:H - Predictable server ISNs enable TCP session hijacking and injection of forged segments into established or newly accepted connections, plus syncookie bypass allows unauthorized connection state to be created under flood conditions.\nA:H - Skipping syncookie and SYN-backlog protections when a stale non-zero ISN is consumed allows unauthenticated resource exhaustion and connection-disruption attacks against listening services."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/tcp.h", "net/ipv4/tcp.c", "net/ipv4/tcp_input.c", "net/ipv4/tcp_ipv4.c", "net/ipv6/tcp_ipv6.c"], "versions": [{"version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028", "lessThan": "8bb6aa419b142dcc2680177ecc39c4c38db7fc16", "status": "affected", "versionType": "git"}, {"version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028", "lessThan": "e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd", "status": "affected", "versionType": "git"}, {"version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028", "lessThan": "4affe063fa56c880cbea8d0bfded0bb80751579d", "status": "affected", "versionType": "git"}, {"version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028", "lessThan": "1bbf0ced1d9db73ac7893c2187f3459288603e0d", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["include/net/tcp.h", "net/ipv4/tcp.c", "net/ipv4/tcp_input.c", "net/ipv4/tcp_ipv4.c", "net/ipv6/tcp_ipv6.c"], "versions": [{"version": "6.10", "status": "affected"}, {"version": "0", "lessThan": "6.10", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.114", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.34", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.11", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.12.114"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "6.18.34"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.0.11"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.10", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8bb6aa419b142dcc2680177ecc39c4c38db7fc16"}, {"url": "https://git.kernel.org/stable/c/e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd"}, {"url": "https://git.kernel.org/stable/c/4affe063fa56c880cbea8d0bfded0bb80751579d"}, {"url": "https://git.kernel.org/stable/c/1bbf0ced1d9db73ac7893c2187f3459288603e0d"}], "title": "tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64024", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:35:24.819208Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:28:08.786Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64024", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-16T15:35:24.819208Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-362", "description": "CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:35:25.413Z"}}], "cna": {"title": "tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 9.4, "baseSeverity": "CRITICAL", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:N - The vulnerable code is reached from the standard IPv4/IPv6 TCP receive path (tcp_v4_rcv/tcp_v6_rcv) when remote attackers send crafted TCP packets to any listening service on the host.\nAC:L - An attacker fully controls the trigger sequence\u2014establishing TIME_WAIT state, deliberately causing drops on documented paths (e.g., SYN+FIN or checksum failure), and spraying SYNs to land on the same CPU via RPS flow hashing\u2014without depending on uncontrollable timing or memory layout.\nPR:N - Exploitation requires only the ability to send TCP packets to a reachable port; no local shell access, capabilities, or authentication is needed on the target system.\nUI:N - No victim user action is required; the attack is conducted entirely by sending network packets to an internet-facing or LAN-reachable server.\nS:U - Impact is confined to the kernel TCP stack on the target host (predictable ISNs, syncookie bypass, session manipulation) and does not cross a VM, container, or IOMMU security boundary.\nC:L - Stale TIME_WAIT ISNs leak predictable sequence-number information that an off-path attacker can use to infer or intercept data on affected TCP connections, bypassing the cryptographically generated ISNs from secure_tcp_seq_and_ts_off().\nI:H - Predictable server ISNs enable TCP session hijacking and injection of forged segments into established or newly accepted connections, plus syncookie bypass allows unauthorized connection state to be created under flood conditions.\nA:H - Skipping syncookie and SYN-backlog protections when a stale non-zero ISN is consumed allows unauthenticated resource exhaustion and connection-disruption attacks against listening services."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028", "lessThan": "8bb6aa419b142dcc2680177ecc39c4c38db7fc16", "versionType": "git"}, {"status": "affected", "version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028", "lessThan": "e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd", "versionType": "git"}, {"status": "affected", "version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028", "lessThan": "4affe063fa56c880cbea8d0bfded0bb80751579d", "versionType": "git"}, {"status": "affected", "version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028", "lessThan": "1bbf0ced1d9db73ac7893c2187f3459288603e0d", "versionType": "git"}], "programFiles": ["include/net/tcp.h", "net/ipv4/tcp.c", "net/ipv4/tcp_input.c", "net/ipv4/tcp_ipv4.c", "net/ipv6/tcp_ipv6.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"status": "unaffected", "version": "0", "lessThan": "6.10", "versionType": "semver"}, {"status": "unaffected", "version": "6.12.114", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.34", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.11", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["include/net/tcp.h", "net/ipv4/tcp.c", "net/ipv4/tcp_input.c", "net/ipv4/tcp_ipv4.c", "net/ipv6/tcp_ipv6.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8bb6aa419b142dcc2680177ecc39c4c38db7fc16"}, {"url": "https://git.kernel.org/stable/c/e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd"}, {"url": "https://git.kernel.org/stable/c/4affe063fa56c880cbea8d0bfded0bb80751579d"}, {"url": "https://git.kernel.org/stable/c/1bbf0ced1d9db73ac7893c2187f3459288603e0d"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction\n\nBlamed commit moved the TIME_WAIT-derived ISN from the skb control\nblock to a per-CPU variable, assuming the value would always be consumed\nby tcp_conn_request() for the same packet that wrote it. That assumption\nis violated by multiple drop paths between the producer\n(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer\n(tcp_conn_request()):\n\n - min_ttl / min_hopcount check\n - xfrm policy check\n - tcp_inbound_hash() MD5/AO mismatch\n - tcp_filter() eBPF/SO_ATTACH_FILTER drop\n - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN\n - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()\n - tcp_checksum_complete() in tcp_v{4,6}_do_rcv()\n - tcp_v{4,6}_cookie_check() returning NULL\n\nWhen a packet is dropped on any of these paths, tcp_tw_isn is left set.\n\nThe next SYN processed on the same CPU then consumes the non zero value in\ntcp_conn_request(), receiving a potentially predictable ISN.\n\nThis patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu\nvariable.\n\nNote that tcp_v{4,6}_fill_cb() do not set it.\n\nVery litle impact on overall code size/complexity:\n\n$ scripts/bloat-o-meter -t vmlinux.old vmlinux.new\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7)\nFunction old new delta\ntcp_v6_rcv 3038 3042 +4\ntcp_v4_rcv 3035 3039 +4\ntcp_conn_request 2938 2923 -15\nTotal: Before=24436060, After=24436053, chg -0.00%"}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.114", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.10"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "6.10"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-21T12:42:55.876Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64024", "state": "PUBLISHED", "dateUpdated": "2026-10-21T12:42:55.876Z", "dateReserved": "2026-07-19T07:54:57.027Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T15:39:16.598Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["include/net/tcp.h", "net/ipv4/tcp.c", "net/ipv4/tcp_input.c", "net/ipv4/tcp_ipv4.c", "net/ipv6/tcp_ipv6.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8bb6aa419b142dcc2680177ecc39c4c38db7fc16", "status": "affected", "version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028", "versionType": "git"}, {"lessThan": "e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd", "status": "affected", "version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028", "versionType": "git"}, {"lessThan": "4affe063fa56c880cbea8d0bfded0bb80751579d", "status": "affected", "version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028", "versionType": "git"}, {"lessThan": "1bbf0ced1d9db73ac7893c2187f3459288603e0d", "status": "affected", "version": "41eecbd712b73f0d5dcf1152b9a1c27b1f238028", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["include/net/tcp.h", "net/ipv4/tcp.c", "net/ipv4/tcp_input.c", "net/ipv4/tcp_ipv4.c", "net/ipv6/tcp_ipv6.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.10"}, {"lessThan": "6.10", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.114", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.34", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.11", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "650D1A9D-F189-4FE4-A377-0BCE6E00F345", "versionEndExcluding": "6.12.114", "versionStartIncluding": "6.10", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction\n\nBlamed commit moved the TIME_WAIT-derived ISN from the skb control\nblock to a per-CPU variable, assuming the value would always be consumed\nby tcp_conn_request() for the same packet that wrote it. That assumption\nis violated by multiple drop paths between the producer\n(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer\n(tcp_conn_request()):\n\n - min_ttl / min_hopcount check\n - xfrm policy check\n - tcp_inbound_hash() MD5/AO mismatch\n - tcp_filter() eBPF/SO_ATTACH_FILTER drop\n - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN\n - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()\n - tcp_checksum_complete() in tcp_v{4,6}_do_rcv()\n - tcp_v{4,6}_cookie_check() returning NULL\n\nWhen a packet is dropped on any of these paths, tcp_tw_isn is left set.\n\nThe next SYN processed on the same CPU then consumes the non zero value in\ntcp_conn_request(), receiving a potentially predictable ISN.\n\nThis patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu\nvariable.\n\nNote that tcp_v{4,6}_fill_cb() do not set it.\n\nVery litle impact on overall code size/complexity:\n\n$ scripts/bloat-o-meter -t vmlinux.old vmlinux.new\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7)\nFunction old new delta\ntcp_v6_rcv 3038 3042 +4\ntcp_v4_rcv 3035 3039 +4\ntcp_conn_request 2938 2923 -15\nTotal: Before=24436060, After=24436053, chg -0.00%"}], "id": "CVE-2026-64024", "lastModified": "2026-10-29T15:55:29.880", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.4, "baseSeverity": "CRITICAL", "confidentialityImpact": "LOW", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.5, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64024", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:35:24.819208Z", "version": "2.0.3"}}]}, "published": "2026-07-19T16:17:42.413", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1bbf0ced1d9db73ac7893c2187f3459288603e0d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/4affe063fa56c880cbea8d0bfded0bb80751579d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8bb6aa419b142dcc2680177ecc39c4c38db7fc16"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-401"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-362"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction", "id": "2502333", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502333"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-342", "details": ["In the Linux kernel, the following vulnerability has been resolved:\ntcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction\nBlamed commit moved the TIME_WAIT-derived ISN from the skb control\nblock to a per-CPU variable, assuming the value would always be consumed\nby tcp_conn_request() for the same packet that wrote it. That assumption\nis violated by multiple drop paths between the producer\n(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer\n(tcp_conn_request()):\n- min_ttl / min_hopcount check\n- xfrm policy check\n- tcp_inbound_hash() MD5/AO mismatch\n- tcp_filter() eBPF/SO_ATTACH_FILTER drop\n- th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN\n- psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()\n- tcp_checksum_complete() in tcp_v{4,6}_do_rcv()\n- tcp_v{4,6}_cookie_check() returning NULL\nWhen a packet is dropped on any of these paths, tcp_tw_isn is left set.\nThe next SYN processed on the same CPU then consumes the non zero value in\ntcp_conn_request(), receiving a potentially predictable ISN.\nThis patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu\nvariable.\nNote that tcp_v{4,6}_fill_cb() do not set it.\nVery litle impact on overall code size/complexity:\n$ scripts/bloat-o-meter -t vmlinux.old vmlinux.new\nadd/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7)\nFunction old new delta\ntcp_v6_rcv 3038 3042 +4\ntcp_v4_rcv 3035 3039 +4\ntcp_conn_request 2938 2923 -15\nTotal: Before=24436060, After=24436053, chg -0.00%", "A flaw was found in the Linux kernel's Transmission Control Protocol (TCP) networking stack. This vulnerability arises from a stale per-CPU variable that can retain a previously used Initial Sequence Number (ISN) when certain packets are dropped. A remote attacker could exploit this by sending specially crafted packets, leading to the prediction of subsequent ISNs. Successful exploitation of predictable ISNs can enable TCP connection hijacking, allowing an attacker to take control of existing network connections."], "name": "CVE-2026-64024", "package_state": [{"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "important", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64024\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64024\nhttps://lore.kernel.org/linux-cve-announce/2026071902-CVE-2026-64024-8c76@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[41eecbd712b73f0d5dcf1152b9a1c27b1f238028,e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[41eecbd712b73f0d5dcf1152b9a1c27b1f238028,4affe063fa56c880cbea8d0bfded0bb80751579d)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[41eecbd712b73f0d5dcf1152b9a1c27b1f238028,1bbf0ced1d9db73ac7893c2187f3459288603e0d)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "generic", "value": "6.10"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[0,6.10)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.34,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.11,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T08:15:02.136608+00:00", "updated": "2026-10-20T09:45:06.517534+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}