VulnerabilityPublished 27 Jul 2026Updated 7 Sep 2026

CVE-2026-64518: Linux kernel · tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().

Affects Linux kernelSource GCVE Database

Not known to be exploited · fixed in 7.0.0-1010.10 : update Linux kernel when convenient.

Data as of 26 Oct 2026, 17:16 UTC

Severity

Medium

Rated by Threat Radar · No CVSS score from NVD or the CNA

EPSS: 0.1% chance of exploitation in 30 days – higher than 6% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
Patch: Available – fixed in 7.0.0-1010.10, 7.0.0-1009.9, 7.0.0-1008.8 +3

Exploitation evidence

Disclosed: evidence found.
CVE published 27 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

ghsa-mfg2-ph7g-pf6h

What to do

Upgrade to a fixed release listed under Affected software.

Affected software

Product	Affected	Fixed in
linux-hwe-edge	Affected <7.0.0-28.28 <7.0.0-1009.9 <7.0.0-1010.10 <7.0.0-1008.8 <6.8.0-139.139 <6.8.0-1067.75	Fixed in 7.0.0-28.28 7.0.0-1009.9 7.0.0-1010.10 7.0.0-1008.8 6.8.0-139.139 6.8.0-1067.75

AI-suggested

A patch is available and has been released by Ubuntu as part of their Linux kernel updates. Users should update their systems to the fixed kernel versions listed in the Ubuntu security notices USN-8618-1 and USN-8663-1 and reboot to apply the changes. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be required. No additional mitigation actions are indicated by the vendor advisory.

Description

A vulnerability in the Linux kernel's TCP implementation involving an out-of-bounds access for the twsk structure in the tcp_ao_established_key() function has been resolved. The issue arises because lockdep_sock_is_held() was used improperly for TCP_TIME_WAIT sockets, which lack the sk_lock member, causing out-of-bounds access. This flaw has been fixed in updated Linux kernel versions. The vulnerability affects multiple versions of the linux-hwe-edge kernel prior to various 7.0.0 and 6.8.x releases. A patch is available, and users are advised to update and reboot their systems. No known exploits are reported in the wild. The severity is assessed as medium.

Impact

The vulnerability could cause out-of-bounds memory access within the Linux kernel TCP stack, potentially leading to system instability or crashes. The advisory does not report any known exploitation in the wild or direct privilege escalation from this specific flaw. The overall impact is considered medium severity. No direct exploit or compromise scenarios are detailed in the available data.

Summary

The Linux kernel vulnerability CVE-2026-64518 involves an out-of-bounds access in the tcp_ao_established_key() function related to the twsk (TCP timewait socket) structure. The function tcp_ao_established_key() calls lockdep_sock_is_held(), which assumes the presence of the sk_lock member in the socket structure. However, TCP_TIME_WAIT sockets do not have this lock, leading to an out-of-bounds access when lockdep_sock_is_held() is invoked from tcp_v[46]_timewait_ack(). This issue was fixed by removing the use of lockdep_sock_is_held() for TCP_TIME_WAIT sockets. The vulnerability affects multiple linux-hwe-edge kernel versions prior to 7.0.0-28.28, 7.0.0-1009.9, 7.0.0-1010.10, 7.0.0-1008.8, and several others in the 6.8.x series. Ubuntu has released patches addressing this and other kernel vulnerabilities in their security notices USN-8618-1 and USN-8663-1. Users must update to the fixed kernel versions and reboot to apply the fix.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Affected software

Description

AI analysisMachine-generated, updated 7 Sep 2026, 17:35 UTC

Technical details

References

Community reviews

Related threats