CVE-2026-64007: Linux kernel netfilter synproxy use-after-free in TCP timestamp handling

Overview

CVE-2026-64007 is a use-after-free in the netfilter synproxy code of the Linux kernel, classified as CWE-416 (Use After Free). The problem appears when the TCP timestamp option is adjusted after a cached TCP header pointer has become stale. The kernel fixed it by re-deriving the header pointer from the packet data after the writability check. The NVD record is at NVD record and the advisory index at GitHub advisory.

Impact

The record describes two possible outcomes: a write into freed memory, or a packet sent with a checksum that does not match its payload.
The record lists the CVSS score as 9.8 with severity critical and describes the technical impact as total in SSVC.
The record does not state the confidentiality, integrity or availability impact beyond the CVSS score, so the precise consequences in a given deployment are unknown.

Affected products and versions

The record lists the Linux kernel with the following ranges, expressed as version endpoints:

From 3.12 up to before 5.10.259.
From 5.11 up to before 5.15.210.
From 5.16 up to before 6.1.176.
From 6.2 up to before 6.6.143.
From 6.7 up to before 6.12.93.
From 6.13 up to before 6.18.35.
From 6.19 up to before 7.0.12.
Development candidates 7.1-rc1, 7.1-rc2, 7.1-rc3, 7.1-rc4 and 7.1-rc5 are also listed.

The separate Linux product entry expresses its ranges with commit identifiers rather than version strings, so this analysis does not convert them into version numbers. Check the stable patch lists for the branch you run, for example the stable patch example.

Exploitation status

The KEV catalog does not list this CVE, so no active exploitation is confirmed by that source. The EPSS record gives a probability of 0.00514 with a percentile of 0.42964 (dated 2026-10-23). The SSVC record shows exploitation as none and automatable as yes. No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

Update the Linux kernel to a stable release that includes the upstream fix, using the version ranges above as a guide for your branch.
Prioritize systems that process network traffic through netfilter synproxy rules, since those are the code paths involved.
Track the vendor and distribution kernel advisories for backported packages, because distribution kernels may carry the fix under a different version string.

Detection guidance

Review kernel logs and crash reports for memory corruption or slab errors around netfilter processing.
Monitor for unexpected TCP checksum failures on connections that pass through synproxy-protected paths.
Confirm the running kernel version against the affected ranges and the stable branch data before assuming exposure.

Limitations of the available information

The record does not state a single fixed version for every branch; the fixes are listed as commit-based patches.
The record does not describe a proof of concept or a triggering condition in detail, so exploitability in real environments is unknown.
The record lists a critical CVSS score, but the sources consulted do not explain how that score maps to a specific deployment.

Frequently asked questions

What is CVE-2026-64007?

It is a use-after-free in the netfilter synproxy code of the Linux kernel, where a cached TCP header pointer becomes stale after a buffer reallocation.

Is this CVE known to be exploited?

It is not listed in the CISA KEV catalog, and the sources consulted show no confirmed exploitation. The SSVC record lists exploitation as none.

How do I remediate it?

Update the Linux kernel to a stable release that contains the upstream fix for your branch, and check your distribution advisories for backported packages.

What is the severity?

The record lists a CVSS score of 9.8 with severity critical.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.