CVE-2026-64007: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64007 Overview

CVE-2026-64007 is a use-after-free vulnerability in the Linux kernel's netfiltersynproxy module. The flaw resides in synproxy_tstamp_adjust(), which patches the TCP checksum through a stale tcphdr pointer after skb_ensure_writable() may have freed the underlying skb->head via pskb_expand_head(). The result is either a write into freed slab memory or transmission of a packet with a stale checksum that does not match its payload. The vulnerability is reachable over the network on hosts using synproxy for SYN flood mitigation, without authentication or user interaction.

Critical Impact
Remote attackers can trigger memory corruption in kernel slab allocations by sending crafted TCP traffic to hosts running netfiltersynproxy, potentially leading to kernel compromise.

Affected Products

Linux kernel builds with CONFIG_NETFILTER_SYNPROXY enabled
IPv4 traffic paths using ipv4_synproxy_hook()
IPv6 traffic paths using ipv6_synproxy_hook()

Discovery Timeline

2026-07-19 - CVE-2026-64007 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64007

Vulnerability Analysis

The vulnerability is a use-after-free [CWE-416] condition in the netfiltersynproxy timestamp adjustment path. Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain a TCP header pointer using skb_header_pointer() before invoking synproxy_tstamp_adjust(). That pointer may alias skb->head directly on a linear socket buffer, or it may point at the caller's on-stack _tcph buffer on a non-linear one.

Inside synproxy_tstamp_adjust(), the code calls skb_ensure_writable(skb, optend). On a cloned or non-linear skb, this triggers pskb_expand_head(), which frees the original skb->head. The cached th pointer is now stale. The subsequent inet_proto_csum_replace4(&th->check, ...) call writes the updated checksum into freed slab memory or into the caller's stack copy that is never propagated back to the wire.

Root Cause

The root cause is a lifetime mismatch between a cached header pointer and the underlying socket buffer storage. skb_ensure_writable() can relocate skb->head, but the calling code continues to dereference the pre-relocation tcphdr pointer for the checksum patch. The TCP option bytes themselves are written through skb->data and remain correct; only the checksum update targets stale memory.

Attack Vector

An unauthenticated remote attacker sends crafted TCP traffic to a host that has synproxy engaged and processes cloned or non-linear socket buffers. Repeated triggers corrupt freed slab objects, which can be leveraged for kernel memory corruption, information disclosure, or transmission of packets with invalid checksums. No user interaction is required.

See the upstream fix at Kernel Git Commit 92170e6 for the corrective patch, which re-derives th from skb->data + protoff immediately after skb_ensure_writable() succeeds.

Detection Methods for CVE-2026-64007

Indicators of Compromise

Unexpected kernel oops or KASAN use-after-free reports referencing synproxy_tstamp_adjust, inet_proto_csum_replace4, or pskb_expand_head.
Elevated volumes of TCP packets egressing the host with invalid checksums, observable via ethtool -S counters or packet capture.
Slab corruption warnings in dmesg on hosts running nftables or iptables rulesets that invoke the SYNPROXY target.

Detection Strategies

Enable KASAN on test kernels to catch use-after-free accesses in the netfiltersynproxy path during fuzzing or load testing.
Audit hosts for active SYNPROXY targets using nft list ruleset or iptables -L -t raw and cross-reference against the running kernel version.
Monitor kernel crash telemetry for panics originating in net/netfilter/nf_synproxy_core.c.

Monitoring Recommendations

Forward kernel logs and crash dumps to a centralized data lake and alert on stack frames containing synproxy_tstamp_adjust.
Track TCP retransmission and checksum error metrics on synproxy-fronted services; sustained anomalies may indicate exploitation attempts.
Correlate northbound TCP traffic patterns with kernel stability events to identify targeted probing.

How to Mitigate CVE-2026-64007

Immediate Actions Required

Apply the upstream Linux kernel patch series referenced by commits 92170e6, 9902a10, a91887a, af2c22c, c7f945f, d3019c6, dd20681, and f0fea2b.
Prioritize patching internet-facing hosts that terminate TCP connections behind SYNPROXY rules.
Reboot affected systems after patching, since the vulnerable code resides in the kernel and cannot be hot-swapped without live-patching infrastructure.

Patch Information

The fix re-derives the TCP header pointer from skb->data + protoff immediately after skb_ensure_writable() returns successfully, ensuring the checksum update targets the linear, writable header rather than stale memory. Distribution kernels should incorporate the stable backports listed in the kernel.org commit references. Consult your Linux distribution's security advisories for backported package versions.

Workarounds

Remove SYNPROXY targets from nftables and iptables rulesets until the kernel patch is applied, if operationally feasible.
Substitute upstream SYN flood mitigations such as net.ipv4.tcp_syncookies=1 on hosts that can tolerate the change in behavior.
Restrict inbound TCP reachability to synproxy-protected services using upstream firewalls or load balancers to reduce exposure.

bash

# Verify running kernel and disable SYNPROXY rules as a temporary workaround
uname -r
sudo nft list ruleset | grep -i synproxy
sudo sysctl -w net.ipv4.tcp_syncookies=1
# Remove SYNPROXY rules (example, adjust to your ruleset)
# sudo nft delete rule inet filter input handle <handle-id>