In the Linux kernel, the following vulnerability has been resolved: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes Reject invalid… (CVE-2026-64422)
Source GCVE Database
Not known to be exploited · CVSS 7.1 High : patch affected systems soon.
Data as of 10/24/2026, 17:08:26 UTC
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 2% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:HWhat to do
AI-suggested
A fix has been implemented in the Linux kernel to validate and reject invalid tcp_reordering sysctl values and to harden the tcp_mtu_probe() function against integer overflow. Users should apply the official kernel updates that include these patches.
Description
A high severity vulnerability (CVE-2026-64422) in the Linux kernel's IPv4 TCP stack allowed invalid negative values for the tcp_reordering sysctl to wrap and cause out-of-bounds reads during MTU probing. This was due to improper validation of sysctl writes and signed integer overflow in tcp_mtu_probe(). The issue has been resolved by adding validation to sysctl inputs and hardening the MTU probe size calculation.
Impact
This vulnerability allows an attacker with local privileges to cause out-of-bounds memory reads in the kernel, potentially leading to denial of service or information disclosure. The CVSS score of 7.1 reflects high impact on confidentiality and availability, with low attack complexity and requiring low privileges but no user interaction.
Summary
The Linux kernel's net.ipv4.tcp_reordering sysctl was vulnerable because it accepted negative values that, when stored as an int and copied into a u32 field, wrapped to large unsigned values. When tcp_mtu_probing was set to 2, this wrapping could cause an overflow in the tcp_mtu_probe() size calculation, leading to out-of-bounds reads. The fix involved rejecting invalid tcp_reordering values before they affect TCP socket state, enforcing minimum values for tcp_reordering and tcp_max_reordering via proc_dointvec_minmax(), relocating pointers for network namespaces, and changing size calculations in tcp_mtu_probe() to use 64-bit arithmetic to prevent signed integer overflow.
Weaknesses
References
- nvd.nist.gov/vuln/detail/CVE-2026-64422 (opens in a new tab)
- git.kernel.org/stable/c/27ddf4486c7dbf5bdd393fa8bef6b67179796d98 (opens in a new tab)
- git.kernel.org/stable/c/782708ca1ea1f68b8cbb5ea3a7f5f18d0000efae (opens in a new tab)
- git.kernel.org/stable/c/99206ce2244f8a3ed64298d0667c9055845a5dc7 (opens in a new tab)
- git.kernel.org/stable/c/a094ac95d3b69adfa1676eb9c8eae6835d4f1671 (opens in a new tab)
- git.kernel.org/stable/c/bbae351c0f32f7c200249e4aa6561b2b419dcf69 (opens in a new tab)
- git.kernel.org/stable/c/e81f805824a8109504fce090641b17d135b48cd1 (opens in a new tab)
- git.kernel.org/stable/c/efb8763d7bbb40cff4cc55a6b62c3095a038149c (opens in a new tab)
- git.kernel.org/stable/c/f0d88a4cd03affff6c08adf6c63964e235aede43 (opens in a new tab)
- cert-portal.siemens.com/productcert/html/ssa-019113.html (opens in a new tab)