CVE-2026-64007

Description

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain that pointer with skb_header_pointer() before calling in, so it may either alias skb->head directly or point at the caller's on-stack _tcph buffer. Between obtaining the pointer and using it, the function calls skb_ensure_writable(skb, optend), which on a cloned or non-linear skb invokes pskb_expand_head() and frees the old skb->head. After that point the cached th is stale: caller (ipv[46]_synproxy_hook) th = skb_header_pointer(skb, ..., &_tcph) synproxy_tstamp_adjust(skb, protoff, th, ...) skb_ensure_writable(skb, optend) pskb_expand_head() /* kfree(old skb->head) */ ... inet_proto_csum_replace4(&th->check, ...) /* writes into freed head, or into the caller's stack copy leaving the on-wire checksum stale */ The option bytes are written through skb->data and are fine; only the checksum update goes through th and so lands in the wrong place. The result is either a write into freed slab memory or a packet leaving with a checksum that does not match its payload. Fix by re-deriving th from skb->data + protoff immediately after skb_ensure_writable() succeeds, so the subsequent checksum update targets the linear, writable header.

CVSS 3.1 breakdown

Remediation

No fixed version is recorded in the NVD data. Check the vendor advisory for the latest guidance.

References

• https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1
• https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c
• https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e
• https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7
• https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96
• https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04
• https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc
• https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf

Frequently asked