PT-2026-64643 · Linux · Linux
CVE-2026-64422
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
Reject invalid
net.ipv4.tcp reordering values before they reach TCP
socket state. The sysctl is stored as an int but copied into the
u32 tp->reordering field for new sockets, so negative writes wrap
to large values.With
tcp mtu probing=2, the wrapped value can overflow the
tcp mtu probe() size calculation and drive the MTU probing path into
an out-of-bounds read. Route tcp reordering writes through
proc dointvec minmax() and require it to be at least 1. Also require
tcp max reordering to be at least 1 so the configured maximum cannot
become negative either.When registering the table for a non-init network namespace, relocate
extra2 pointers that refer into init net.ipv4 so the
tcp reordering upper bound follows that namespace's
tcp max reordering.Harden
tcp mtu probe() itself by computing size needed as u64.
This keeps the send queue and window checks from being bypassed through
signed integer overflow. Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux