CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
In the Linux kernel, the following vulnerability has been resolved:
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
Reject invalid net.ipv4.tcpreordering values before they reach TCP socket state. The sysctl is stored as an int but copied into the u32 tp->reordering field for new sockets, so negative writes wrap to large values.
With tcpmtuprobing=2, the wrapped value can overflow the tcpmtuprobe() size calculation and drive the MTU probing path into an out-of-bounds read. Route tcpreordering writes through procdointvecminmax() and require it to be at least 1. Also require tcpmaxreordering to be at least 1 so the configured maximum cannot become negative either.
When registering the table for a non-init network namespace, relocate extra2 pointers that refer into initnet.ipv4 so the tcpreordering upper bound follows that namespace's tcpmaxreordering.
Harden tcpmtuprobe() itself by computing sizeneeded as u64. This keeps the send queue and window checks from being bypassed through signed integer overflow.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 6.6.145.2-1 - Configuration
Apply the kernel fix that hardens tcp_mtu_probe()/MTU probing size handling when tcp_mtu_probing=2 prevents wrapped size_needed overflow from bypassing checks into the tcp_reordering bound.
Linux kernel sysctl net.ipv4.tcp_mtu_probing net.ipv4.tcp_mtu_probing = 2 - Configuration
Apply the kernel fix to reject invalid net.ipv4.tcp_reordering sysctl values before they reach TCP so negative writes cannot wrap and lead to out-of-bounds read of reordering.
Linux kernel sysctl net.ipv4.tcp_reordering net.ipv4.tcp_reordering = validate non-negative before reaching TCP - Configuration
Apply the kernel fix so proc_dointvec_minmax() requires tcp_max_reordering to be at least 1, preventing configured maximum from being bypassed by negative values wrapping/overflow.
Linux kernel sysctl net.ipv4.tcp_max_reordering net.ipv4.tcp_max_reordering = at least 1
Event History
Frequently Asked Questions
What access and configuration are required to trigger the vulnerable path?
An attacker needs local access with privileges sufficient to write the net.ipv4.tcp_reordering sysctl. TCP MTU probing must be configured as tcp_mtu_probing=2 for the described out-of-bounds read path to be reachable.
Are normal tcp_reordering values affected?
The issue is caused by invalid negative tcp_reordering values, which are stored as an int and then wrap when copied into an unsigned TCP socket field. The fix rejects tcp_reordering values below 1 and also prevents tcp_max_reordering from being negative.
What can be done before applying the patch?
Prevent untrusted local users or workloads from modifying the relevant network sysctls. Do not set net.ipv4.tcp_reordering or net.ipv4.tcp_max_reordering to negative values, and avoid tcp_mtu_probing=2 where it is not required.
How can I determine whether a system has been exposed to this condition?
Check whether negative values were written to net.ipv4.tcp_reordering or net.ipv4.tcp_max_reordering, particularly on systems using tcp_mtu_probing=2. The provided data does not identify a separate reliable runtime indicator of successful exploitation.