CVE-2026-64422: Linux Kernel Privilege Escalation Flaw

CVE-2026-64422 Overview

CVE-2026-64422 is a Linux kernel vulnerability in the IPv4 TCP stack. The flaw stems from unbounded writes to the net.ipv4.tcp_reordering sysctl. The sysctl is stored as a signed int but copied into the u32 field tp->reordering for new sockets, causing negative values to wrap into large unsigned integers. When combined with tcp_mtu_probing=2, the wrapped value overflows the size calculation in tcp_mtu_probe() and drives the MTU probing path into an out-of-bounds read.

Critical Impact
A local user with permission to write TCP sysctls can trigger an out-of-bounds read in the kernel TCP MTU probing path, leading to kernel memory disclosure or denial of service.

Affected Products

Linux kernel IPv4 TCP stack (net/ipv4)
Systems with net.ipv4.tcp_mtu_probing set to 2
Multiple stable kernel branches referenced in the upstream fix commits

Discovery Timeline

2026-07-25 - CVE-2026-64422 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64422

Vulnerability Analysis

The vulnerability is an integer overflow leading to an out-of-bounds read [CWE-125, CWE-190] in the Linux kernel TCP subsystem. The net.ipv4.tcp_reordering sysctl accepted arbitrary signed integer values without validation. Because the value is later stored in the unsigned u32 tp->reordering field of new TCP sockets, negative writes wrap to very large unsigned values.

When tcp_mtu_probing=2 is enabled, tcp_mtu_probe() uses tp->reordering in its size_needed calculation. The wrapped value causes signed integer overflow in this computation, bypassing the send queue and window bounds checks. The MTU probing logic then reads beyond allocated buffer boundaries.

Root Cause

The root cause is a combination of missing input validation and unsafe type conversion. The sysctl handler did not route tcp_reordering writes through proc_dointvec_minmax() with a minimum of 1, allowing zero and negative values. The tcp_max_reordering sysctl had the same weakness, permitting a negative configured maximum. Additionally, size_needed in tcp_mtu_probe() was computed using signed arithmetic that could overflow.

Attack Vector

Exploitation requires local access with privileges to write to /proc/sys/net/ipv4/tcp_reordering in a network namespace. An attacker sets a negative or otherwise invalid value, enables tcp_mtu_probing=2, and initiates TCP traffic that triggers the MTU probing path. The resulting out-of-bounds read can expose adjacent kernel memory or crash the kernel.

The upstream fix rejects invalid sysctl writes via proc_dointvec_minmax(), requires both tcp_reordering and tcp_max_reordering to be at least 1, relocates extra2 pointers so non-init namespaces respect their own tcp_max_reordering, and computes size_needed as u64 inside tcp_mtu_probe(). See the upstream fix commit for the full patch.

Detection Methods for CVE-2026-64422

Indicators of Compromise

Unexpected writes to /proc/sys/net/ipv4/tcp_reordering or /proc/sys/net/ipv4/tcp_max_reordering containing zero or negative values
Kernel oops or KASAN reports referencing tcp_mtu_probe() in the call stack
Systems where net.ipv4.tcp_mtu_probing has been changed to 2 outside of normal configuration management

Detection Strategies

Audit sysctl write activity through auditd rules on /proc/sys/net/ipv4/tcp_reordering and /proc/sys/net/ipv4/tcp_max_reordering
Monitor kernel ring buffer output for TCP subsystem warnings, MTU probe anomalies, and KASAN out-of-bounds read reports
Correlate unprivileged namespace creation with subsequent TCP sysctl writes to identify container escape attempts

Monitoring Recommendations

Ingest kernel logs and audit records into a centralized SIEM to alert on sysctl tampering by non-root users inside user namespaces
Track running kernel versions across the fleet and flag hosts still on vulnerable builds
Baseline expected values of net.ipv4.tcp_reordering, tcp_max_reordering, and tcp_mtu_probing and alert on drift

How to Mitigate CVE-2026-64422

Immediate Actions Required

Apply the kernel updates that include the referenced upstream commits to all affected Linux systems
Restrict write access to network sysctls in unprivileged user namespaces where feasible
Set net.ipv4.tcp_mtu_probing to 0 or 1 on hosts that do not require aggressive MTU probing

Patch Information

The fix is distributed across multiple stable branches. Relevant commits include 27ddf4486c7d, 782708ca1ea1, 99206ce2244f, a094ac95d3b6, bbae351c0f32, e81f805824a8, efb8763d7bbb, and f0d88a4cd03a. Consult your distribution's security tracker for the specific package versions containing these commits and rebuild or update the kernel accordingly.

Workarounds

Explicitly set net.ipv4.tcp_reordering to a valid positive integer such as 3 and net.ipv4.tcp_max_reordering to a valid positive integer such as 300
Disable tcp_mtu_probing by setting net.ipv4.tcp_mtu_probing=0 until the patched kernel is deployed
Limit CAP_NET_ADMIN inside user namespaces to reduce the population of local principals able to write TCP sysctls

bash

# Configuration example: enforce safe defaults until patched
sysctl -w net.ipv4.tcp_mtu_probing=0
sysctl -w net.ipv4.tcp_reordering=3
sysctl -w net.ipv4.tcp_max_reordering=300

# Persist across reboots
cat <<EOF >> /etc/sysctl.d/99-cve-2026-64422.conf
net.ipv4.tcp_mtu_probing = 0
net.ipv4.tcp_reordering = 3
net.ipv4.tcp_max_reordering = 300
EOF
sysctl --system