CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable

CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable

[Greg Kroah-Hartman]

From: Greg Kroah-Hartman <gregkh@kernel.org>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

netfilter: synproxy: refresh tcphdr after skb_ensure_writable

synproxy_tstamp_adjust() rewrites the TCP timestamp option in place
and then patches the TCP checksum via inet_proto_csum_replace4() on
the caller-supplied tcphdr pointer.  Both ipv4_synproxy_hook() and
ipv6_synproxy_hook() obtain that pointer with skb_header_pointer()
before calling in, so it may either alias skb->head directly or
point at the caller's on-stack _tcph buffer.

Between obtaining the pointer and using it, the function calls
skb_ensure_writable(skb, optend), which on a cloned or non-linear
skb invokes pskb_expand_head() and frees the old skb->head.  After
that point the cached th is stale:

    caller (ipv[46]_synproxy_hook)
      th = skb_header_pointer(skb, ..., &_tcph)
      synproxy_tstamp_adjust(skb, protoff, th, ...)
        skb_ensure_writable(skb, optend)
          pskb_expand_head()        /* kfree(old skb->head) */
        ...
        inet_proto_csum_replace4(&th->check, ...)
                                    /* writes into freed head, or
                                       into the caller's stack copy
                                       leaving the on-wire checksum
                                       stale */

The option bytes are written through skb->data and are fine; only
the checksum update goes through th and so lands in the wrong
place.  The result is either a write into freed slab memory or a
packet leaving with a checksum that does not match its payload.

Fix by re-deriving th from skb->data + protoff immediately after
skb_ensure_writable() succeeds, so the subsequent checksum update
targets the linear, writable header.

The Linux kernel CVE team has assigned CVE-2026-64007 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 5.10.259 with commit 9902a1058992de5d95656b64a3bd95c077f7ba2c
	Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 5.15.210 with commit d3019c61799adc21811af4b521f11f3dc77f8e04
	Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 6.1.176 with commit dd206819f210522579010d889d45a9530bb494bc
	Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 6.6.143 with commit af2c22ccb1f621aff487ff47a040e38e058541e7
	Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 6.12.93 with commit c7f945f7da097245a2f8ed7775ce48421047ee96
	Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 6.18.35 with commit f0fea2b6d5453a11ad11713bbf37561b9b3a7edf
	Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 7.0.12 with commit a91887a5b6ee4b98dfbf1db657ed2b879430149e
	Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 7.1 with commit 92170e6afe927ab2792a3f71902845789c8e31b1

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64007
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/netfilter/nf_synproxy_core.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c
	https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04
	https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc
	https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7
	https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96
	https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf
	https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e
	https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1