CVE-2026-64007: netfilter: synproxy: refresh tcphdr after skb_ensure_writable
In the Linux kernel, the following vulnerability has been resolved:
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 6.12.111-1Fixed in 7.2.8-1Fixed in 7.2.9-1 - Compensating control
In netfilter synproxy_tstamp_adjust(), after skb_ensure_writable(skb, optend) succeeds, re-derive the TCP header pointer from skb->data + protoff before calling inet_proto_csum_replace4(), so the checksum update targets the linear, writable header.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64007?
CVE-2026-64007 is classified with a risk rating of 37, indicating a notable vulnerability in the Linux kernel.
How do I fix CVE-2026-64007?
To remediate CVE-2026-64007, update your Linux kernel to the latest version that includes the patch for this vulnerability.
What type of vulnerability is CVE-2026-64007?
CVE-2026-64007 is a netfilter vulnerability related to the synproxy feature in the Linux kernel.
What systems are affected by CVE-2026-64007?
The vulnerability CVE-2026-64007 affects systems running affected versions of the Linux kernel.
When was CVE-2026-64007 published?
CVE-2026-64007 was published on July 19, 2026.