CVE-2026-23247: Linux Kernel Information Disclosure Flaw

CVE-2026-23247 Overview

A vulnerability has been resolved in the Linux kernel related to the TCP secure sequence number generation mechanism. The fix reverts a previous change (commit 28ee1b746f49) that had downgraded timestamp offsets to per-host level. This vulnerability allows off-path TCP source port leakage via a SYN cookie side-channel attack.

The original change was made when tcp_tw_recycle was removed in 2017, but it inadvertently created a security weakness. The resolution brings back TCP ports in timestamp (TS) offset randomization, which helps prevent the leakage of TCP source port information. As an optimization, the fix performs a single siphash() computation to provide both an ISN (Initial Sequence Number) and a TS offset.

Critical Impact
Off-path attackers can exploit this vulnerability to leak TCP source port information through SYN cookie timing side-channels, potentially enabling connection hijacking or reconnaissance attacks.

Affected Products

Linux Kernel (various versions prior to the fix)

Discovery Timeline

March 18, 2026 - CVE-2026-23247 published to NVD
March 18, 2026 - Last updated in NVD database

Technical Details for CVE-2026-23247

Vulnerability Analysis

This vulnerability exists in the Linux kernel's TCP secure sequence number generation subsystem. The core issue stems from the previous decision to downgrade timestamp offsets from per-connection to per-host granularity. While this simplification was considered safe after the removal of tcp_tw_recycle in 2017, it inadvertently created a side-channel vulnerability.

The weakness allows remote attackers to infer TCP source port information by analyzing timing characteristics of SYN cookies. This type of side-channel attack can be performed off-path, meaning attackers don't need to be in the direct network path between the client and server.

Root Cause

The root cause is the removal of port-specific entropy from the TCP timestamp offset calculation. When timestamp offsets were downgraded to per-host values, it created predictable patterns that could be exploited through careful timing analysis of SYN cookie responses. The original per-connection randomization using ports provided necessary entropy to prevent such inference attacks.

Attack Vector

The attack leverages the predictable nature of per-host timestamp offsets. An off-path attacker can send crafted packets and analyze the timing characteristics of SYN cookie responses to deduce the TCP source ports being used by a target host. This information could be used for:

Connection hijacking attempts
Targeted denial of service attacks
Network reconnaissance and fingerprinting
Bypassing certain firewall or intrusion detection rules

The fix addresses this by reintroducing port values into the timestamp offset calculation and optimizing the implementation to use a single siphash() call for both the Initial Sequence Number (ISN) and timestamp offset generation.

Detection Methods for CVE-2026-23247

Indicators of Compromise

Unusual patterns of SYN packets from multiple source IPs targeting the same destination
Anomalous timing analysis activity in network traffic
Increased volume of TCP connection attempts with timing correlation patterns
Evidence of port scanning followed by targeted connection attempts

Detection Strategies

Monitor network traffic for patterns consistent with SYN cookie timing side-channel attacks
Implement deep packet inspection to identify unusual TCP timestamp analysis behavior
Use intrusion detection systems configured to alert on suspicious TCP handshake patterns
Deploy kernel-level monitoring to track TCP sequence number generation anomalies

Monitoring Recommendations

Enable TCP connection logging to track unusual connection patterns
Configure network monitoring tools to baseline normal SYN cookie behavior
Implement alerting for statistical anomalies in TCP timestamp distributions
Review kernel audit logs for signs of exploitation attempts

How to Mitigate CVE-2026-23247

Immediate Actions Required

Update the Linux kernel to a patched version that includes the fix
Review network security controls for exposure to off-path attacks
Consider implementing additional network segmentation to limit attacker reconnaissance capabilities
Monitor systems for signs of exploitation while awaiting patch deployment

Patch Information

The vulnerability has been fixed in the Linux kernel through multiple commits. The fix reverts the per-host timestamp offset approach and reintroduces port-specific randomization using an optimized single siphash() computation.

Relevant kernel commits:

Workarounds

Deploy network-level defenses such as rate limiting SYN packets to reduce attack surface
Consider enabling SYN proxy features on network security appliances
Implement strict ingress filtering to limit off-path attack opportunities
Use network segmentation to isolate critical systems from potential reconnaissance