CVE-2026-64518

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().

lockdep_sock_is_held() was added in tcp_ao_established_key()

by the cited commit.

It can be called from tcp_v[46]_timewait_ack() with twsk.

Since it does not have sk->sk_lock, the lockdep annotation

results in out-of-bound access.

$ pahole -C tcp_timewait_sock vmlinux | grep size

/* size: 288, cachelines: 5, members: 8 */

$ pahole -C sock vmlinux | grep sk_lock

socket_lock_t sk_lock; /* 440 192 */

Let's not use lockdep_sock_is_held() for TCP_TIME_WAIT.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References