SECUFOCUSNOW
Home›CVE index›CVE-2026-64007
Review reviewCritical

CVE-2026-64007

Linux

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain that pointer with skb_header_pointer() before calling in, so it may either alias skb->head directly or point at the caller's on-stack _tcph buffer. Between obtaining the pointer and using it, the function calls skb_ensure_writable(skb, o...

CVSS
9.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.20
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 9.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain that pointer with skb_header_pointer() before calling in, so it may either alias skb->head directly or point at the caller's on-stack _tcph buffer. Between obtaining the pointer and using it, the function calls skb_ensure_writable(skb, o...

Affected product and versions

Product
Linux
Affected versions
>= 48b1de4c110a7afa4b85862f6c75af817db26fad < 9902a1058992de5d95656b64a3bd95c077f7ba2c, >= 48b1de4c110a7afa4b85862f6c75af817db26fad < d3019c61799adc21811af4b521f11f3dc77f8e04, >= 48b1de4c110a7afa4b85862f6c75af817db26fad < dd206819f210522579010d889d45a9530bb494bc, >= 48b1de4c110a7afa4b85862f6c75af817db26fad < af2c22ccb1f621aff487ff47a040e38e058541e7, >= 48b1de4c110a7afa4b85862f6c75af817db26fad < c7f945f7da097245a2f8ed7775ce48421047ee96, >= 48b1de4c110a7afa4b85862f6c75af817db26fad < f0fea2b6d5453a11ad11713bbf37561b9b3a7edf, >= 48b1de4c110a7afa4b85862f6c75af817db26fad < a91887a5b6ee4b98dfbf1db657ed2b879430149e, >= 48b1de4c110a7afa4b85862f6c75af817db26fad < 92170e6afe927ab2792a3f71902845789c8e31b1, >= 3.12
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available
CVE-2026-64007 — Linux | SECUFOCUS NOW