CVE-2026-23247: tcp: secure_seq: add back ports to TS offset
In the Linux kernel, the following vulnerability has been resolved:
tcp: secureseq: add back ports to TS offset
This reverts 28ee1b746f49 ("secureseq: downgrade to per-host timestamp offsets")
tcptwrecycle went away in 2017.
Zhouyan Deng reported off-path TCP source port leakage via SYN cookie side-channel that can be fixed in multiple ways.
One of them is to bring back TCP ports in TS offset randomization.
As a bonus, we perform a single siphash() computation to provide both an ISN and a TS offset.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local attack access and low privileges are required. No user interaction is required.
What is the practical impact if exploitation succeeds?
The reported issue is an off-path TCP source-port leakage through a SYN-cookie side channel. The CVSS assessment rates the impact as high availability impact, with no confidentiality or integrity impact.
What change resolves the issue?
The fix restores TCP port values to TCP timestamp-offset randomization, reversing an earlier change that used per-host timestamp offsets. It also uses one siphash computation to generate both an initial sequence number and timestamp offset.