Answer in brief
CVE-2026-64024 records a Critical severity (CVSS 9.4) vulnerability in tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
CVSS is 9.4. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Product | Affected versions | Fixed versions |
|---|---|---|
| cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:* | Not reported | Not reported |
| cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:* | Not reported | Not reported |
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=41eecbd712b73f0d5dcf1152b9a1c27b1f238028 <e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd || >=41eecbd712b73f0d5dcf1152b9a1c27b1f238028 <4affe063fa56c880cbea8d0bfded0bb80751579d || >=41eecbd712b73f0d5dcf1152b9a1c27b1f238028 <1bbf0ced1d9db73ac7893c2187f3459288603e0d | e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd, 4affe063fa56c880cbea8d0bfded0bb80751579d, 1bbf0ced1d9db73ac7893c2187f3459288603e0d |
| Linux/Linuxgeneric | 6.10 | Not reported |
| Linux/Linuxgeneric | >=41eecbd712b73f0d5dcf1152b9a1c27b1f238028 <8bb6aa419b142dcc2680177ecc39c4c38db7fc16 || >=41eecbd712b73f0d5dcf1152b9a1c27b1f238028 <e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd || >=41eecbd712b73f0d5dcf1152b9a1c27b1f238028 <4affe063fa56c880cbea8d0bfded0bb80751579d || >=41eecbd712b73f0d5dcf1152b9a1c27b1f238028 <1bbf0ced1d9db73ac7893c2187f3459288603e0d | 8bb6aa419b142dcc2680177ecc39c4c38db7fc16, e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd, 4affe063fa56c880cbea8d0bfded0bb80751579d, 1bbf0ced1d9db73ac7893c2187f3459288603e0d |
Published upstream
Jul 19, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Oct 29, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction Blamed commit moved the TIME_WAIT-derived ISN from the skb control block to a per-CPU variable, assuming the value would always be consumed by tcp_conn_request() for the same packet that wrote it. That assumption is violated by multiple drop paths between the producer (__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer (tcp_conn_request()): - min_ttl / min_hopcount check - xfrm policy check - tcp_inbound_hash() MD5/AO mismatch - tcp_filter() eBPF/SO_ATTACH_FILTER drop - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv() - tcp_checksum_complete() in tcp_v{4,6}_do_rcv() - tcp_v{4,6}_cookie_check() returning NULL When a packet is dropped on any of these paths, tcp_tw_isn is left set. The next SYN processed on the same CPU then consumes the non zero value in tcp_conn_request(), receiving a potentially predictable ISN. This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu variable. Note that tcp_v{4,6}_fill_cb() do not set it. Very litle impact on overall code size/complexity: $ scripts/bloat-o-meter -t vmlinux.old vmlinux.new add/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7) Function old new delta tcp_v6_rcv 3038 3042 +4 tcp_v4_rcv 3035 3039 +4 tcp_conn_request 2938 2923 -15 Total: Before=24436060, After=24436053, chg -0.00%
Quoted source text, attributed separately from HOL analysis.