CVE-2026-64024 Linux CVE debrief

Who should care

Linux kernel users and administrators should be aware of this vulnerability and ensure their systems are updated with the latest kernel patches. This includes reviewing system logs for potential exploitation attempts and monitoring for unusual network activity. Additionally, Linux distribution maintainers and security teams should prioritize patching and verifying the integrity of kernel updates.

Technical summary

The vulnerability was caused by a commit that moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable. However, this assumption was violated by multiple drop paths, leading to a stale per-CPU tcp_tw_isn leak. The patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-CPU variable. This change prevents the potentially predictable ISN issue. The fix involves reversion of the per-CPU tcp_tw_isn variable, ensuring that the ISN value is always consumed by tcp_conn_request() for the same packet that wrote it, thereby preventing the leak.

Defensive priority

High priority for Linux kernel administrators and users to apply the patch and monitor for potential exploitation attempts.

Recommended defensive actions

• Apply the latest Linux kernel patches
• Ensure systems are updated with the latest kernel patches
• Monitor system logs for potential exploitation attempts
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The vulnerability was resolved by moving back tcp_tw_isn to skb->cb[]. The issue arose from the assumption that the TIME_WAIT-derived ISN would always be consumed by tcp_conn_request() for the same packet that wrote it. Multiple drop paths, such as min_ttl / min_hopcount check, xfrm policy check, tcp_inbound_hash() MD5/AO mismatch, tcp_filter() eBPF/SO_ATTACH_FILTER drop, th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN, psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv(), tcp_checksum_complete() in tcp_v{4,6}_do_rcv(), and tcp_v{4,6}_cookie_check() returning NULL, can cause the tcp_tw_isn to be left set. The next SYN processed on the same CPU then consumes the non-zero value in tcp_conn_request(), receiving a potentially predictable ISN.

Official resources