CVE-2026-64024: Linux kernel TCP: stale per-CPU ISN leak enabling prediction

Overview

The record describes a stale per-CPU value in the Linux kernel TCP stack. A TIME_WAIT-derived initial sequence number (ISN) was moved from the skb control block to a per-CPU variable. The kernel assumed the value would always be consumed by the same packet's processing, but several drop paths leave it set. The next SYN handled on that CPU can then use the leftover value. The record states that the fix moves the variable back to skb->cb[].

Impact

The record says the next SYN on the same CPU may receive a potentially predictable ISN.
Predictable ISNs can weaken TCP connection integrity against off-path attackers. This is an inference from general TCP behavior, not a statement in the record.
The CNA rates the CVE critical with CVSS 3.1 score 9.4 and vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H.
The CWE listed in the record is CWE-401 (Missing Release of Memory after Effective Lifetime). This is the classification as recorded and may not fully match the described behavior.

Affected products and versions

The CNA record lists the Linux kernel with the following ranges:

From 6.10 up to before 6.18.34.
From 6.19 up to before 7.0.11.
7.1-rc1, 7.1-rc2, 7.1-rc3 and 7.1-rc4.

The affected list also contains commit-based ranges that start at an earlier commit and end at each fix commit. Consult the affected entries in the record for those exact boundaries. The record does not state a final fixed release for the 7.1 line.

Exploitation status

The CISA KEV catalog does not list this CVE in the record. The record also gives an SSVC exploitation value of none and an EPSS probability of 0.00308 (percentile 0.22392). No confirmed exploitation appears in the sources consulted.

Remediation and mitigation

Update to a Linux kernel release that includes the fix. The record links patch commits for the stable branches, including the 6.18.34 stable commit, the stable commit for the 6.19 line and the stable commit for the 7.0 line.
Distributions and vendors may ship backports under their own version numbers. Check your vendor's advisories.
The record does not describe a workaround. Organizations that cannot patch promptly should follow their own risk processes.

Detection guidance

Inventory hosts running affected kernel ranges, including 7.1 release candidates where used.
Review kernel version and vendor patch level as part of routine vulnerability management.
The record does not describe specific indicators of compromise. Detection content for this issue is not available in the sources consulted.

Limitations of the available information

The record does not provide a final fixed version for the 7.1 line.
The record does not include a proof of concept, a practical exploitation scenario or measured impact on real deployments.
The attack feasibility against real systems is not confirmed by the sources consulted.

Frequently asked questions

What is the root cause of CVE-2026-64024?

According to the record, a TIME_WAIT-derived ISN was stored in a per-CPU variable that stays set when several packet drop paths discard a packet before it is consumed. The fix moves the value back to the skb control block.

Which Linux kernel versions are listed as affected?

The record lists the range from 6.10 up to before 6.18.34, the range from 6.19 up to before 7.0.11, and the release candidates 7.1-rc1 through 7.1-rc4.

Is this CVE known to be exploited in the wild?

The record shows it is not listed in CISA KEV and has an SSVC exploitation value of none. No confirmed exploitation appears in the sources consulted.

This analysis was drafted with AI assistance from verified source data and automatically checked against it.