CVE-2026-64007

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: synproxy: refresh tcphdr after skb_ensure_writable

synproxy_tstamp_adjust() rewrites the TCP timestamp option in place

and then patches the TCP checksum via inet_proto_csum_replace4() on

the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and

ipv6_synproxy_hook() obtain that pointer with skb_header_pointer()

before calling in, so it may either alias skb->head directly or

point at the caller's on-stack _tcph buffer.

Between obtaining the pointer and using it, the function calls

skb_ensure_writable(skb, optend), which on a cloned or non-linear

skb invokes pskb_expand_head() and frees the old skb->head. After

that point the cached th is stale:

caller (ipv[46]_synproxy_hook)

th = skb_header_pointer(skb, ..., &_tcph)

synproxy_tstamp_adjust(skb, protoff, th, ...)

skb_ensure_writable(skb, optend)

pskb_expand_head() /* kfree(old skb->head) */

...

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References