CVE-2026-64007

CVE CVE-2026-64007EUVD EUVD-2026-45580Published 2026-07-19T14:56:23.000ZLast changed 2026-08-05T12:38:06.000ZCVSS 9.8

What the advisory describes

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain that pointer with skb_header_pointer() before calling in, so it may either alias skb->head directly or point at the caller's on-stack _tcph buffer. Between obtaining the pointer and using it, the function calls skb_ensure_writable(skb, optend), which on a cloned or non-linear skb invokes pskb_expand_head() and frees the old skb->head. After that point the cached th is stale: caller (ipv[46]_synproxy_hook) th = skb_header_pointer(skb, ..., &_tcph) synproxy_tstamp_adjust(skb, protoff, th, ...) skb_ensure_writable(skb, optend) pskb_expand_head() /* kfree(old skb->head) */ ... inet_proto_csum_replace4(&th->check, ...) /* writes into freed head, or into the caller's stack copy leaving the on-wire checksum stale */ The option bytes are written through skb->data and are fine; only the checksum update goes through th and so lands in the wrong place. The result is either a write into freed slab memory or a packet leaving with a checksum that does not match its payload. Fix by re-deriving th from skb->data + protoff immediately after skb_ensure_writable() succeeds, so the subsequent checksum update targets the linear, writable header.

Source: EUVD (ENISA), in the words of the advisory.

Products the advisory names

These come from the advisory itself, not from any check we performed.

• Linux — Linux 48b1de4c110a7afa4b85862f6c75af817db26fad <a91887a5b6ee4b98dfbf1db657ed2b879430149e; 48b1de4c110a7afa4b85862f6c75af817db26fad <f0fea2b6d5453a11ad11713bbf37561b9b3a7edf; 48b1de4c110a7afa4b85862f6c75af817db26fad <9902a1058992de5d95656b64a3bd95c077f7ba2c; patch: 6.6.143; 48b1de4c110a7afa4b85862f6c75af817db26fad <af2c22ccb1f621aff487ff47a040e38e058541e7; 48b1de4c110a7afa4b85862f6c75af817db26fad <d3019c61799adc21811af4b521f11f3dc77f8e04; patch: 7.0.12; patch: 6.1.176; patch: 5.10.259; 48b1de4c110a7afa4b85862f6c75af817db26fad <92170e6afe927ab2792a3f71902845789c8e31b1; patch: 6.12.93; 48b1de4c110a7afa4b85862f6c75af817db26fad <c7f945f7da097245a2f8ed7775ce48421047ee96; patch: 0; patch: 6.18.35; patch: 7.1; 48b1de4c110a7afa4b85862f6c75af817db26fad <dd206819f210522579010d889d45a9530bb494bc; 3.12; patch: 5.15.210

The versions shown are the advisory's own. Patchlage compares no version numbers and derives no judgement from them — which version is installed is something a person has to look up.

Carried in the product catalogue

An estate covering these products can be recorded in Patchlage. An advisory about them appears in the next morning's situation report.

• Linux — Linux

Patchlage reports hits and suspected hits. About everything else this system says nothing — neither this page nor the situation report ever claims that an estate is safe.