From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-alma10-1.taild15c8.ts.net [100.103.45.18]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id E8248224AF9 for ; Sun, 19 Jul 2026 15:03:26 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=100.103.45.18 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784473408; cv=none; b=Lt4JwNyAe6Qp8pScHNVJXMrfLYpGusWqsO44q8Aqj3/0GEFBFICuYufYj/JvO7YfReXksyuH3J+pcpdlU540TL96GmAD51YWPvVCBBLSyNhqQ9GXaSAjwTEIXBesZb46U9uHcqBNC9fB06DklCqZS0GIY1gEKCkWjG8eafTYsZ8= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1784473408; c=relaxed/simple; bh=4bynuSSm6B1p6zWrz6LurlNBqyoR0zeywMExWYvhwqI=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=K1ECYTfxaElRVDQD1XyFjyKxm4KUags66jgYxjP5npMSGHkoSr8dBMzcnnFcUzSn9SkRLMx21sqkSXvj0pib8mDe1wyUogth/b0t2A9Fbd34ClhaGL1qTj7DbXwyTAt9nIsovbJEeeex+HbDr5Hoxkedwg6jAEiod/NbxgyaFEY= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=bXVqi4GT; arc=none smtp.client-ip=100.103.45.18 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="bXVqi4GT" Received: by smtp.kernel.org (Postfix) with ESMTPSA id 56B2F1F00A3A; Sun, 19 Jul 2026 15:03:26 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linuxfoundation.org; s=korg; t=1784473406; bh=ps0gjv6+ReEtQqCOO1to2IJLhb0DLG/LI8RXzD4tKZA=; h=From:To:Cc:Subject:Date:Reply-To; b=bXVqi4GTMBJdU1rn33E0+Yz12MM6Lpfb25PNCkrMp4gQNyluDeqaQWHHN/i04iD+E oQHK1oH41F4OKDEOwRrhCslm3aKnty6TVx5Unz3ZvJhzldMUJQms3fjDY+La+mB/xJ Pw7Lel7zeWXZX70zePND8Iv8rEbTQ0HP+ddE3l7E= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable Date: Sun, 19 Jul 2026 16:57:47 +0200 Message-ID: <2026071908-CVE-2026-64007-5e61@gregkh> X-Mailer: git-send-email 2.55.0 Reply-To: , Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 X-Developer-Signature: v=1; a=openpgp-sha256; l=4772; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=leZ8hGn4DWgptmRQ6NoAscP/DQRwylq2Wyhr4Ch96+Y=; b=owGbwMvMwCRo6H6F97bub03G02pJDFkxTzssPiYtnaOalnb909pfHhEcZavbap+tZFjaLB3TZ OTsXsTYEcvCIMjEICumyPJlG8/R/RWHFL0MbU/DzGFlAhnCwMUpABO58JVhrqTRtE2/nyf0pzZ5 cd5p2qR+6sJfEYb5JUwvWv6c+XNe603An4j6uTV97luLAA== X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit From: Greg Kroah-Hartman Description =========== In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain that pointer with skb_header_pointer() before calling in, so it may either alias skb->head directly or point at the caller's on-stack _tcph buffer. Between obtaining the pointer and using it, the function calls skb_ensure_writable(skb, optend), which on a cloned or non-linear skb invokes pskb_expand_head() and frees the old skb->head. After that point the cached th is stale: caller (ipv[46]_synproxy_hook) th = skb_header_pointer(skb, ..., &_tcph) synproxy_tstamp_adjust(skb, protoff, th, ...) skb_ensure_writable(skb, optend) pskb_expand_head() /* kfree(old skb->head) */ ... inet_proto_csum_replace4(&th->check, ...) /* writes into freed head, or into the caller's stack copy leaving the on-wire checksum stale */ The option bytes are written through skb->data and are fine; only the checksum update goes through th and so lands in the wrong place. The result is either a write into freed slab memory or a packet leaving with a checksum that does not match its payload. Fix by re-deriving th from skb->data + protoff immediately after skb_ensure_writable() succeeds, so the subsequent checksum update targets the linear, writable header. The Linux kernel CVE team has assigned CVE-2026-64007 to this issue. Affected and fixed versions =========================== Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 5.10.259 with commit 9902a1058992de5d95656b64a3bd95c077f7ba2c Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 5.15.210 with commit d3019c61799adc21811af4b521f11f3dc77f8e04 Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 6.1.176 with commit dd206819f210522579010d889d45a9530bb494bc Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 6.6.143 with commit af2c22ccb1f621aff487ff47a040e38e058541e7 Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 6.12.93 with commit c7f945f7da097245a2f8ed7775ce48421047ee96 Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 6.18.35 with commit f0fea2b6d5453a11ad11713bbf37561b9b3a7edf Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 7.0.12 with commit a91887a5b6ee4b98dfbf1db657ed2b879430149e Issue introduced in 3.12 with commit 48b1de4c110a7afa4b85862f6c75af817db26fad and fixed in 7.1 with commit 92170e6afe927ab2792a3f71902845789c8e31b1 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64007 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: net/netfilter/nf_synproxy_core.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04 https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7 https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96 https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1