Skip to content
CVE PROGRAM SOURCE RECORD9.8 Critical

CVE-2026-64007

netfilter: synproxy: refresh tcphdr after skb_ensure_writable

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain that pointer with skb_header_pointer() before calling in, so it may either alias skb->head directly or point at the caller's on-stack _tcph buffer. Between obtaining the pointer and using it, the function calls skb_ensure_writable(skb, optend), which on a cloned or non-linear skb invokes pskb_expand_head() and frees the old skb->head. After that point the cached th is stale: caller (ipv[46]_synproxy_hook) th = skb_header_pointer(skb, ..., &_tcph) synproxy_tstamp_adjust(skb, protoff, th, ...) skb_ensure_writable(skb, optend) pskb_expand_head() /* kfree(old skb->head) */ ... inet_proto_csum_replace4(&th->check, ...) /* writes into freed head, or into the caller's stack copy leaving the on-wire checksum stale */ The option bytes are written through skb->data and are fine; only the checksum update goes through th and so lands in the wrong place. The result is either a write into freed slab memory or a packet leaving with a checksum that does not match its payload. Fix by re-deriving th from skb->data + protoff immediately after skb_ensure_writable() succeeds, so the subsequent checksum update targets the linear, writable header.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • 48b1de4c110a7afa4b85862f6c75af817db26fad to < 9902a1058992de5d95656b64a3bd95c077f7ba2caffected
  • 48b1de4c110a7afa4b85862f6c75af817db26fad to < d3019c61799adc21811af4b521f11f3dc77f8e04affected
  • 48b1de4c110a7afa4b85862f6c75af817db26fad to < dd206819f210522579010d889d45a9530bb494bcaffected
  • 48b1de4c110a7afa4b85862f6c75af817db26fad to < af2c22ccb1f621aff487ff47a040e38e058541e7affected
  • 48b1de4c110a7afa4b85862f6c75af817db26fad to < c7f945f7da097245a2f8ed7775ce48421047ee96affected
  • 48b1de4c110a7afa4b85862f6c75af817db26fad to < f0fea2b6d5453a11ad11713bbf37561b9b3a7edfaffected
  • 48b1de4c110a7afa4b85862f6c75af817db26fad to < a91887a5b6ee4b98dfbf1db657ed2b879430149eaffected
  • 48b1de4c110a7afa4b85862f6c75af817db26fad to < 92170e6afe927ab2792a3f71902845789c8e31b1affected

Linux Linux

Default version status: affected

  • 3.12affected
  • 0 to < 3.12unaffected
  • 5.10.259 to ≤ 5.10.*unaffected
  • 5.15.210 to ≤ 5.15.*unaffected
  • 6.1.176 to ≤ 6.1.*unaffected
  • 6.6.143 to ≤ 6.6.*unaffected
  • 6.12.93 to ≤ 6.12.*unaffected
  • 6.18.35 to ≤ 6.18.*unaffected
  • 7.0.12 to ≤ 7.0.*unaffected
  • 7.1 to ≤ *unaffected

References