CVE-2026-64024 Overview
CVE-2026-64024 is a Linux kernel vulnerability in the TCP subsystem that allows remote attackers to predict Initial Sequence Numbers (ISNs). The flaw stems from a stale per-CPU tcp_tw_isn value that leaks between packets when a SYN is dropped along one of several kernel receive paths. A subsequent SYN handled on the same CPU consumes the leftover TIME_WAIT-derived ISN in tcp_conn_request(), receiving a potentially predictable sequence number. ISN prediction weakens TCP session integrity and enables spoofing and injection attacks against connections that depend on sequence number unpredictability.
Critical Impact
Attackers can trigger ISN prediction over the network without authentication, undermining TCP session integrity across affected Linux kernel builds.
Affected Products
- Linux kernel versions containing the blamed commit that moved tcp_tw_isn from skb->cb[] to a per-CPU variable
- Distributions shipping the vulnerable TCP stack in tcp_v4_rcv and tcp_v6_rcv
- Systems using standard IPv4/IPv6 TCP with TIME_WAIT socket reuse
Discovery Timeline
- 2026-07-19 - CVE-2026-64024 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64024
Vulnerability Analysis
The vulnerability resides in the Linux kernel TCP receive path. A prior commit moved the TIME_WAIT-derived ISN from the socket buffer control block (skb->cb[]) into a per-CPU variable named tcp_tw_isn. The change assumed that whichever CPU wrote the value via __this_cpu_write(tcp_tw_isn, isn) in tcp_v4_rcv() or tcp_v6_rcv() would immediately consume it inside tcp_conn_request() for the same packet.
That assumption breaks whenever a packet is dropped between the producer and the consumer. The leftover ISN remains in the per-CPU slot and is picked up by the next SYN processed on that CPU, leaking a predictable value derived from an earlier TIME_WAIT socket state. Attackers who influence traffic on the target CPU can therefore infer the ISN used for a subsequent connection request.
Root Cause
The root cause is unsafe state sharing across independent packets. Multiple drop paths sit between the write and the read, including the min_ttl and min_hopcount check, the xfrm policy check, tcp_inbound_hash() MD5/AO mismatches, tcp_filter() eBPF and SO_ATTACH_FILTER drops, the th->syn && th->fin discard inside tcp_rcv_state_process() under TCP_LISTEN, psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv(), tcp_checksum_complete() failures, and tcp_v{4,6}_cookie_check() returning NULL. Any of these drops leaves tcp_tw_isn populated for the next SYN on the same CPU.
Attack Vector
An unauthenticated remote attacker sends crafted TCP traffic that traverses one of the affected drop paths, seeding the per-CPU slot with a known TIME_WAIT-derived ISN. The attacker then follows with a SYN that reaches tcp_conn_request() on the same CPU and consumes the stale value. Predictable ISNs enable off-path TCP spoofing, blind injection into new connections, and hijacking scenarios against services that rely on ISN randomness for session integrity.
The upstream fix moves tcp_tw_isn back to skb->cb[], binding the value to the specific packet that produced it and eliminating cross-packet leakage. The patch adds four bytes to tcp_v4_rcv and tcp_v6_rcv and reduces tcp_conn_request by fifteen bytes.
Detection Methods for CVE-2026-64024
Indicators of Compromise
- Unexpected TCP RST or duplicate SYN-ACK patterns on listening sockets that correlate with high volumes of dropped inbound SYNs
- Successful TCP connections that appear to originate from spoofed source addresses
- Elevated counters for LINUX_MIB_TCPMD5FAILURE, LINUX_MIB_TCPMINTTLDROP, or XFRM policy drops preceding suspicious connection establishment
Detection Strategies
- Compare running kernel versions against the fixed commits 1bbf0ced1d9db73ac7893c2187f3459288603e0d, 4affe063fa56c880cbea8d0bfded0bb80751579d, and e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd in the stable tree
- Monitor /proc/net/netstat and nstat for spikes in SYN drop counters that could indicate probing of the vulnerable code paths
- Correlate host-level TCP drop telemetry with network IDS alerts for TCP session anomalies such as out-of-window segments
Monitoring Recommendations
- Enable kernel tracepoints on tcp:tcp_receive_reset and tcp:tcp_bad_csum to surface abnormal receive-path activity
- Baseline expected TCP handshake behavior per host and alert on statistically anomalous ISN reuse or connection spoofing indicators
- Ingest kernel version, patch level, and TCP MIB counters into a central data lake for fleet-wide detection queries
How to Mitigate CVE-2026-64024
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced in the stable commit 1bbf0ced, stable commit 4affe063, and stable commit e47f7060
- Rebuild or upgrade to a distribution kernel that includes the fix restoring tcp_tw_isn to skb->cb[]
- Prioritize patching of internet-facing hosts and load balancers terminating TCP connections
Patch Information
The fix removes the per-CPU tcp_tw_isn variable and restores the value inside the per-skb control block. tcp_v4_fill_cb() and tcp_v6_fill_cb() do not initialize the field, so the value now travels with the packet that produced it. Overall code size change is negligible per scripts/bloat-o-meter output.
Workarounds
- Disable TCP MD5, AO, and BPF socket filters where feasible to reduce the number of drop paths that populate the stale ISN, understanding this weakens other protections
- Deploy strict ingress filtering and anti-spoofing ACLs to limit an attacker's ability to inject crafted SYN traffic
- Restrict min_ttl and min_hopcount configuration changes that increase drop-path frequency until the kernel patch is applied
# Verify running kernel and confirm patch inclusion
uname -r
grep -E 'tcp_tw_isn' /proc/kallsyms || echo 'symbol removed - likely patched'
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
