The Linux kernel vulnerability CVE-2026-64422 involves improper validation of the net.ipv4.tcp_reordering sysctl parameter. Negative values written to this sysctl wrap around when copied into an unsigned 32-bit field, potentially causing an overflow in the tcp_mtu_probe size calculation. This overflow can lead to out-of-bounds memory reads during MTU probing when tcp_mtu_probing is set to 2. The fix includes enforcing minimum values for tcp_reordering and tcp_max_reordering via proc_dointvec_minmax(), relocating pointers for network namespaces, and computing size_needed as a 64-bit value to prevent signed integer overflow in tcp_mtu_probe().

The vulnerability can cause out-of-bounds memory reads in the kernel's TCP MTU probing path, which may lead to kernel memory disclosure or instability. However, no known exploits are reported in the wild. The impact is limited to systems with tcp_mtu_probing set to 2 and where invalid tcp_reordering values are written.

A fix has been implemented in the Linux kernel to validate and bound tcp_reordering sysctl writes and harden the tcp_mtu_probe function. Users should apply the official kernel updates that include this fix. Since this is a kernel-level vulnerability, updating to the patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; check the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.