CVE-2026-64518: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64518 Overview

CVE-2026-64518 is a Linux kernel vulnerability in the TCP subsystem. The flaw allows an out-of-bounds memory access in the tcp_ao_established_key() function when it is invoked with a tcp_timewait_sock (twsk) structure. The function calls lockdep_sock_is_held(), which was introduced by a prior commit and assumes the socket contains an sk_lock field. Because tcp_timewait_sock is only 288 bytes and does not include sk_lock at offset 440, the lockdep annotation reads memory beyond the allocated structure. The upstream fix removes the lockdep_sock_is_held() check for TCP_TIME_WAIT sockets.

Critical Impact
The defect triggers an out-of-bounds read in the Linux kernel networking stack when TCP-AO time-wait sockets process ACKs, potentially leading to memory disclosure or kernel instability.

Affected Products

Linux Kernel (upstream, mainline)
Linux Kernel stable branches containing the introducing commit for tcp_ao_established_key() lockdep annotation
Distributions shipping kernels with TCP Authentication Option (TCP-AO) support enabled

Discovery Timeline

2026-07-25 - CVE-2026-64518 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64518

Vulnerability Analysis

The vulnerability resides in the Linux kernel TCP Authentication Option (TCP-AO) implementation, specifically in tcp_ao_established_key(). A prior commit added a lockdep_sock_is_held() assertion to this function to validate that the socket lock is held during key lookup. The assertion expects a full struct sock and dereferences the sk_lock member at byte offset 440.

However, tcp_ao_established_key() is reachable from tcp_v4_timewait_ack() and tcp_v6_timewait_ack(), which pass a tcp_timewait_sock (twsk). The tcp_timewait_sock structure occupies only 288 bytes and does not carry an sk_lock field. As a result, lockdep reads memory 152 bytes past the end of the allocation, producing an out-of-bounds access flagged by KASAN.

Root Cause

The root cause is an incorrect type assumption in tcp_ao_established_key(). The function was annotated with a lock-held check that is only valid for full-fledged sockets, yet TCP time-wait processing legitimately calls it with the smaller tcp_timewait_sock object. The size delta between the two structures (288 bytes versus one containing sk_lock at offset 440) causes the debug assertion to read unrelated memory.

Attack Vector

The defect is triggered on the local host during normal TCP time-wait processing when TCP-AO keys are configured. An attacker with the ability to establish TCP-AO connections that transition to TCP_TIME_WAIT can induce the out-of-bounds read path. The impact primarily manifests as kernel memory read beyond object bounds, which may leak adjacent slab contents to lockdep or KASAN reporting paths and can destabilize kernels compiled with debugging enabled. See the Linux Kernel Change Log for the patch details.

// No verified exploit code available.
// The fix removes lockdep_sock_is_held() usage on the TCP_TIME_WAIT path
// so that tcp_timewait_sock is not incorrectly treated as a full struct sock.

Detection Methods for CVE-2026-64518

Indicators of Compromise

KASAN or lockdep splats in dmesg referencing tcp_ao_established_key on the time-wait ACK path
Kernel warnings originating from tcp_v4_timewait_ack or tcp_v6_timewait_ack when TCP-AO is in use
Unexpected kernel stack traces on hosts running TCP-AO enabled workloads such as BGP sessions

Detection Strategies

Inventory running kernel versions and compare against the fixed commits 03cb001ef87b, 29cf64d128c9, 510db031ba6e, and 87bb3e719042 referenced in the kernel.org stable tree
Identify hosts with CONFIG_TCP_AO=y configured, since only these kernels reach the vulnerable path
Correlate kernel crash telemetry with TCP-AO session churn to spot repeated trigger conditions

Monitoring Recommendations

Forward dmesg and /var/log/kern.log to centralized logging and alert on KASAN, UBSAN, and lockdep messages
Monitor kernel panic and soft-lockup counters on systems running BGP or other TCP-AO protected services
Track patch state of Linux kernel packages across the fleet through configuration management

How to Mitigate CVE-2026-64518

Immediate Actions Required

Apply the upstream kernel patch that removes lockdep_sock_is_held() usage in tcp_ao_established_key() for TCP_TIME_WAIT sockets
Update to a stable kernel release that contains commits 03cb001ef87b, 29cf64d128c9, 510db031ba6e, or 87bb3e719042
Prioritize patching hosts terminating TCP-AO sessions such as BGP routers and their control-plane peers

Patch Information

The fix is available in the mainline and stable kernel trees. Refer to the Linux Kernel Change Log for commit 03cb001ef87b, commit 29cf64d128c9, commit 510db031ba6e, and commit 87bb3e719042. Rebuild or install vendor-provided kernel packages that include these commits and reboot affected systems.

Workarounds

Disable TCP-AO on services that do not require it until a patched kernel is deployed
Avoid running kernels with CONFIG_PROVE_LOCKING or KASAN in production if immediate patching is not possible, understanding this only suppresses the out-of-bounds report and not the underlying defect
Restrict which peers can establish TCP-AO sessions to reduce exposure of the vulnerable code path

bash

# Verify running kernel version and check for the fix
uname -r

# On Debian/Ubuntu, upgrade the kernel package
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r | sed 's/-generic//')

# On RHEL/CentOS/Fedora, upgrade the kernel package
sudo dnf update kernel

# Reboot to activate the patched kernel
sudo systemctl reboot