{"id":"CVE-2026-64007","summary":"netfilter: synproxy: refresh tcphdr after skb_ensure_writable","details":"In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: refresh tcphdr after skb_ensure_writable\n\nsynproxy_tstamp_adjust() rewrites the TCP timestamp option in place\nand then patches the TCP checksum via inet_proto_csum_replace4() on\nthe caller-supplied tcphdr pointer.  Both ipv4_synproxy_hook() and\nipv6_synproxy_hook() obtain that pointer with skb_header_pointer()\nbefore calling in, so it may either alias skb-\u003ehead directly or\npoint at the caller's on-stack _tcph buffer.\n\nBetween obtaining the pointer and using it, the function calls\nskb_ensure_writable(skb, optend), which on a cloned or non-linear\nskb invokes pskb_expand_head() and frees the old skb-\u003ehead.  After\nthat point the cached th is stale:\n\n    caller (ipv[46]_synproxy_hook)\n      th = skb_header_pointer(skb, ..., &_tcph)\n      synproxy_tstamp_adjust(skb, protoff, th, ...)\n        skb_ensure_writable(skb, optend)\n          pskb_expand_head()        /* kfree(old skb-\u003ehead) */\n        ...\n        inet_proto_csum_replace4(&th-\u003echeck, ...)\n                                    /* writes into freed head, or\n                                       into the caller's stack copy\n                                       leaving the on-wire checksum\n                                       stale */\n\nThe option bytes are written through skb-\u003edata and are fine; only\nthe checksum update goes through th and so lands in the wrong\nplace.  The result is either a write into freed slab memory or a\npacket leaving with a checksum that does not match its payload.\n\nFix by re-deriving th from skb-\u003edata + protoff immediately after\nskb_ensure_writable() succeeds, so the subsequent checksum update\ntargets the linear, writable header.","modified":"2026-07-22T05:29:38.225123088Z","published":"2026-07-19T14:56:23.049Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64007.json","cna_assigner":"Linux"},"references":[{"type":"WEB","url":"https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1"},{"type":"WEB","url":"https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c"},{"type":"WEB","url":"https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e"},{"type":"WEB","url":"https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7"},{"type":"WEB","url":"https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96"},{"type":"WEB","url":"https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04"},{"type":"WEB","url":"https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc"},{"type":"WEB","url":"https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64007.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64007"},{"type":"PACKAGE","url":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","events":[{"introduced":"48b1de4c110a7afa4b85862f6c75af817db26fad"},{"fixed":"9902a1058992de5d95656b64a3bd95c077f7ba2c"},{"fixed":"d3019c61799adc21811af4b521f11f3dc77f8e04"},{"fixed":"dd206819f210522579010d889d45a9530bb494bc"},{"fixed":"af2c22ccb1f621aff487ff47a040e38e058541e7"},{"fixed":"c7f945f7da097245a2f8ed7775ce48421047ee96"},{"fixed":"f0fea2b6d5453a11ad11713bbf37561b9b3a7edf"},{"fixed":"a91887a5b6ee4b98dfbf1db657ed2b879430149e"},{"fixed":"92170e6afe927ab2792a3f71902845789c8e31b1"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64007.json"}},{"package":{"name":"Kernel","ecosystem":"Linux"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.12.0"},{"fixed":"5.10.259"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.11.0"},{"fixed":"5.15.210"}]},{"type":"ECOSYSTEM","events":[{"introduced":"5.16.0"},{"fixed":"6.1.176"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.2.0"},{"fixed":"6.6.143"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.7.0"},{"fixed":"6.12.93"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.13.0"},{"fixed":"6.18.35"}]},{"type":"ECOSYSTEM","events":[{"introduced":"6.19.0"},{"fixed":"7.0.12"}]}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64007.json"}}],"schema_version":"1.7.5","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}