High [CVE-2026-64007] refresh tcphdr after skb_ensure_writable
This high-severity Red Hat Linux advisory covers CVE-2026-64007 affecting Red Hat Enterprise Linux 9, Red Hat Enterprise Linux 10, Red Hat Enterprise Linux 7.
Android app · Google Play
Monitor future Red Hat Linux CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Summary
In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer.
Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain that pointer with skb_header_pointer() before calling in, so it may either alias skb->head directly or point at the caller's on-stack _tcph buffer.
Between obtaining the pointer and using it, the function calls skb_ensure_writable(skb, optend), which on a cloned or non-linear skb invokes pskb_expand_head() and frees the old skb->head.
After that point the cached th is stale: caller (ipv[46]_synproxy_hook) th = skb_header_pointer(skb,..., &_tcph) synproxy_tstamp_adjust(skb, protoff, th,...) skb_ensure_writable(skb, optend) pskb_expand_head() /* kfree(old skb->head) */... inet_proto_csum_replace4(&th->check,...) /* writes into freed head, or into the caller's stack copy leaving the on-wire checksum stale */ The option bytes are written through skb->data and are fine; only the checksum update goes through th and so lands in the wrong place.
The result is either a write into freed slab memory or a packet leaving with a checksum that does not match its payload.
Affected versions
No affected-version range was extracted from the source record. The vendor advisory is authoritative — check it before change work.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
- kernel-0:5.14.0-687.41.1.el9_8
- RHSA-2026:57252
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Mitigation
Upgrade to a fixed release: kernel-0:5.14.0-687.41.1.el9_8, RHSA-2026:57252. That is the remediation for this advisory.
The vendor advisory may list additional interim mitigations or workarounds not captured here — review it before change work.
Official advisory · high-confidence parse· fetched 6 days ago·verify at source
Discussion(0)
No comments yet. Share field notes, upgrade gotchas, or questions — verify against the vendor advisory before acting on community advice.
Sign in to join the discussion.