Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-64024

In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the producer (__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer (tcp_conn_request()): -
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:cd7d4025371ec5bbecbc5c47e035fff4b326859fb6893c066ce3d62ec3c450d3
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/tcp.h","net/ipv4/tcp.c","net/ipv4/tcp_input.c","net/ipv4/tcp_ipv4.c","net/ipv6/tcp_ipv6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.11","versionType":"semver"},{"lessThanOrEqual":"*","st…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:4c465e4d523c5cb2144778e43a03df550ef5decee5604379a70062e989f4878c · sha256:778fb5aad99d223d… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/tcp.h","net/ipv4/tcp.c","net/ipv4/tcp_input.c","net/ipv4/tcp_ipv4.c","net/ipv6/tcp_ipv6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd","status":"affected","version":"41eecbd712b73f0d5dcf1152b9a1c27b1f238028","versionType":"git"},{"lessThan":"4affe063fa56c880cbea8d0bfded0bb80751579d","status":"affected","version":"41eecbd712b73f0d5dcf1152b9a1c27b1f238028","versionType":"git"},{"lessThan":"1bbf0ced1d9db73ac…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:4c465e4d523c5cb2144778e43a03df550ef5decee5604379a70062e989f4878c · sha256:778fb5aad99d223d… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["include/net/tcp.h","net/ipv4/tcp.c","net/ipv4/tcp_input.c","net/ipv4/tcp_ipv4.c","net/ipv6/tcp_ipv6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.10"},{"lessThan":"6.10","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.11","versionType":"semver"},{"lessThanOrEqual":"*","st…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:4c465e4d523c5cb2144778e43a03df550ef5decee5604379a70062e989f4878c · sha256:778fb5aad99d223d… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["include/net/tcp.h","net/ipv4/tcp.c","net/ipv4/tcp_input.c","net/ipv4/tcp_ipv4.c","net/ipv6/tcp_ipv6.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd","status":"affected","version":"41eecbd712b73f0d5dcf1152b9a1c27b1f238028","versionType":"git"},{"lessThan":"4affe063fa56c880cbea8d0bfded0bb80751579d","status":"affected","version":"41eecbd712b73f0d5dcf1152b9a1c27b1f238028","versionType":"git"},{"lessThan":"1bbf0ced1d9db73ac…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:4c465e4d523c5cb2144778e43a03df550ef5decee5604379a70062e989f4878c · sha256:778fb5aad99d223d… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":9.4,"baseSeverity":"CRITICAL","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:4c465e4d523c5cb2144778e43a03df550ef5decee5604379a70062e989f4878c · sha256:778fb5aad99d223d… · /containers/cna/metrics/0/cvssV3_1

Source references

3 source assertions
{"url":"https://git.kernel.org/stable/c/1bbf0ced1d9db73ac7893c2187f3459288603e0d"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4c465e4d523c5cb2144778e43a03df550ef5decee5604379a70062e989f4878c · sha256:778fb5aad99d223d… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/4affe063fa56c880cbea8d0bfded0bb80751579d"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4c465e4d523c5cb2144778e43a03df550ef5decee5604379a70062e989f4878c · sha256:778fb5aad99d223d… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:4c465e4d523c5cb2144778e43a03df550ef5decee5604379a70062e989f4878c · sha256:778fb5aad99d223d… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer