PT-2026-64643 · Linux · Linux

CVE-2026-64422

·

Publicado

2026-07-25

·

Atualizado

2026-07-25

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
Reject invalid net.ipv4.tcp reordering values before they reach TCP socket state. The sysctl is stored as an int but copied into the u32 tp->reordering field for new sockets, so negative writes wrap to large values.
With tcp mtu probing=2, the wrapped value can overflow the tcp mtu probe() size calculation and drive the MTU probing path into an out-of-bounds read. Route tcp reordering writes through proc dointvec minmax() and require it to be at least 1. Also require tcp max reordering to be at least 1 so the configured maximum cannot become negative either.
When registering the table for a non-init network namespace, relocate extra2 pointers that refer into init net.ipv4 so the tcp reordering upper bound follows that namespace's tcp max reordering.
Harden tcp mtu probe() itself by computing size needed as u64. This keeps the send queue and window checks from being bypassed through signed integer overflow.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64422

Produtos afetados

Linux