Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-64518

In the Linux kernel, the following vulnerability has been resolved: tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). lockdep_sock_is_held() was added in tcp_ao_established_key() by the cited commit. It can be called from tcp_v[46]_timewait_ack() with twsk. Since it does not have sk->sk_lock, the lockdep annotation results in out-of-bound access. $ pahole -C tcp_timewait_sock vmlinux | grep size /* size: 288, cachelines: 5, members: 8 */ $ pahole -C sock vmlinux | g
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:a0e9edf01cecd7261fe5b27fec8259a491ad8e2062c6160ee87cf2566827cf6f
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/tcp_ao.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.92","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.11","versionType":"semver"},{"lessThanOrEqua…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a2481e458faf6cdf3605f09fa092e274d1a5f514743ca856d7f83984979a8dab · sha256:44396d55be90cd84… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/tcp_ao.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"87bb3e719042f0030a6dad39118c6a6b2a491ad9","status":"affected","version":"051f49d5176613dea88ecf73a101c3a99f4720e9","versionType":"git"},{"lessThan":"510db031ba6eb40134f84c90ef963ea4b6dfb878","status":"affected","version":"6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6","versionType":"git"},{"lessThan":"29cf64d128c94cf98d1c69d8b2962d39db5ff4c6","status":"affected","version":"6b2d11e2d8fc130df4708be0b6b5…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a2481e458faf6cdf3605f09fa092e274d1a5f514743ca856d7f83984979a8dab · sha256:44396d55be90cd84… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["net/ipv4/tcp_ao.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.13"},{"lessThan":"6.13","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.92","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.11","versionType":"semver"},{"lessThanOrEqua…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a2481e458faf6cdf3605f09fa092e274d1a5f514743ca856d7f83984979a8dab · sha256:44396d55be90cd84… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/ipv4/tcp_ao.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"87bb3e719042f0030a6dad39118c6a6b2a491ad9","status":"affected","version":"051f49d5176613dea88ecf73a101c3a99f4720e9","versionType":"git"},{"lessThan":"510db031ba6eb40134f84c90ef963ea4b6dfb878","status":"affected","version":"6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6","versionType":"git"},{"lessThan":"29cf64d128c94cf98d1c69d8b2962d39db5ff4c6","status":"affected","version":"6b2d11e2d8fc130df4708be0b6b5…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:a2481e458faf6cdf3605f09fa092e274d1a5f514743ca856d7f83984979a8dab · sha256:44396d55be90cd84… · /containers/cna/affected/0

Source references

4 source assertions
{"url":"https://git.kernel.org/stable/c/03cb001ef87b3f8d859cf7f96329acf3d6235d29"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a2481e458faf6cdf3605f09fa092e274d1a5f514743ca856d7f83984979a8dab · sha256:44396d55be90cd84… · /containers/cna/references/3
{"url":"https://git.kernel.org/stable/c/29cf64d128c94cf98d1c69d8b2962d39db5ff4c6"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a2481e458faf6cdf3605f09fa092e274d1a5f514743ca856d7f83984979a8dab · sha256:44396d55be90cd84… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/510db031ba6eb40134f84c90ef963ea4b6dfb878"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a2481e458faf6cdf3605f09fa092e274d1a5f514743ca856d7f83984979a8dab · sha256:44396d55be90cd84… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/87bb3e719042f0030a6dad39118c6a6b2a491ad9"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:a2481e458faf6cdf3605f09fa092e274d1a5f514743ca856d7f83984979a8dab · sha256:44396d55be90cd84… · /containers/cna/references/0

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer