The Linux kernel contained a vulnerability (CVE-2026-64518) in the TCP code where the function tcp_ao_established_key() used lockdep_sock_is_held() on a tcp_timewait_sock (twsk) structure. Since TCP_TIME_WAIT sockets lack the sk_lock member, the lockdep annotation caused an out-of-bounds memory access. The fix involved not using lockdep_sock_is_held() for TCP_TIME_WAIT sockets, thereby preventing this invalid access.

The vulnerability could lead to out-of-bounds memory access in kernel space, which may cause kernel instability or crashes. No information about exploitation in the wild or further impact such as privilege escalation or denial of service is provided.

A fix has been implemented in the Linux kernel source code to avoid using lockdep_sock_is_held() for TCP_TIME_WAIT sockets, resolving the out-of-bounds access issue. Users should apply the official Linux kernel updates that include this fix once available. Patch status is not explicitly confirmed in the provided data; therefore, check the vendor advisory for current remediation guidance.