Vulnerability-Lookup

CVE-2026-64007 (GCVE-0-2026-64007)

Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-08-05 12:38

Title

netfilter: synproxy: refresh tcphdr after skb_ensure_writable

Summary

In the Linux kernel, the following vulnerability has been resolved: netfilter: synproxy: refresh tcphdr after skb_ensure_writable synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer. Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain that pointer with skb_header_pointer() before calling in, so it may either alias skb->head directly or point at the caller's on-stack _tcph buffer. Between obtaining the pointer and using it, the function calls skb_ensure_writable(skb, optend), which on a cloned or non-linear skb invokes pskb_expand_head() and frees the old skb->head. After that point the cached th is stale: caller (ipv[46]_synproxy_hook) th = skb_header_pointer(skb, ..., &_tcph) synproxy_tstamp_adjust(skb, protoff, th, ...) skb_ensure_writable(skb, optend) pskb_expand_head() /* kfree(old skb->head) */ ... inet_proto_csum_replace4(&th->check, ...) /* writes into freed head, or into the caller's stack copy leaving the on-wire checksum stale */ The option bytes are written through skb->data and are fine; only the checksum update goes through th and so lands in the wrong place. The result is either a write into freed slab memory or a packet leaving with a checksum that does not match its payload. Fix by re-deriving th from skb->data + protoff immediately after skb_ensure_writable() succeeds, so the subsequent checksum update targets the linear, writable header.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux mitre root

References

8 references

URL	Tags
https://git.kernel.org/stable/c/9902a1058992de5d9…
https://git.kernel.org/stable/c/d3019c61799adc218…
https://git.kernel.org/stable/c/dd206819f21052257…
https://git.kernel.org/stable/c/af2c22ccb1f621aff…
https://git.kernel.org/stable/c/c7f945f7da097245a…
https://git.kernel.org/stable/c/f0fea2b6d5453a11a…
https://git.kernel.org/stable/c/a91887a5b6ee4b98d…
https://git.kernel.org/stable/c/92170e6afe927ab27…

Impacted products

2 products

Vendor	Product	Version	CPE status
Linux	Linux	Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < 9902a1058992de5d95656b64a3bd95c077f7ba2c (git) Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < d3019c61799adc21811af4b521f11f3dc77f8e04 (git) Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < dd206819f210522579010d889d45a9530bb494bc (git) Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < af2c22ccb1f621aff487ff47a040e38e058541e7 (git) Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < c7f945f7da097245a2f8ed7775ce48421047ee96 (git) Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < f0fea2b6d5453a11ad11713bbf37561b9b3a7edf (git) Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < a91887a5b6ee4b98dfbf1db657ed2b879430149e (git) Affected: 48b1de4c110a7afa4b85862f6c75af817db26fad , < 92170e6afe927ab2792a3f71902845789c8e31b1 (git)	guessed
Linux	Linux	Affected: 3.12 Unaffected: 0 , < 3.12 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix)	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_synproxy_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "9902a1058992de5d95656b64a3bd95c077f7ba2c",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "d3019c61799adc21811af4b521f11f3dc77f8e04",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "dd206819f210522579010d889d45a9530bb494bc",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "af2c22ccb1f621aff487ff47a040e38e058541e7",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "c7f945f7da097245a2f8ed7775ce48421047ee96",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "f0fea2b6d5453a11ad11713bbf37561b9b3a7edf",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "a91887a5b6ee4b98dfbf1db657ed2b879430149e",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            },
            {
              "lessThan": "92170e6afe927ab2792a3f71902845789c8e31b1",
              "status": "affected",
              "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/netfilter/nf_synproxy_core.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.12"
            },
            {
              "lessThan": "3.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.259",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.210",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.176",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.143",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.93",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.12",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.259",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.210",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.176",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.143",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.93",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.12",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "3.12",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: refresh tcphdr after skb_ensure_writable\n\nsynproxy_tstamp_adjust() rewrites the TCP timestamp option in place\nand then patches the TCP checksum via inet_proto_csum_replace4() on\nthe caller-supplied tcphdr pointer.  Both ipv4_synproxy_hook() and\nipv6_synproxy_hook() obtain that pointer with skb_header_pointer()\nbefore calling in, so it may either alias skb-\u003ehead directly or\npoint at the caller\u0027s on-stack _tcph buffer.\n\nBetween obtaining the pointer and using it, the function calls\nskb_ensure_writable(skb, optend), which on a cloned or non-linear\nskb invokes pskb_expand_head() and frees the old skb-\u003ehead.  After\nthat point the cached th is stale:\n\n    caller (ipv[46]_synproxy_hook)\n      th = skb_header_pointer(skb, ..., \u0026_tcph)\n      synproxy_tstamp_adjust(skb, protoff, th, ...)\n        skb_ensure_writable(skb, optend)\n          pskb_expand_head()        /* kfree(old skb-\u003ehead) */\n        ...\n        inet_proto_csum_replace4(\u0026th-\u003echeck, ...)\n                                    /* writes into freed head, or\n                                       into the caller\u0027s stack copy\n                                       leaving the on-wire checksum\n                                       stale */\n\nThe option bytes are written through skb-\u003edata and are fine; only\nthe checksum update goes through th and so lands in the wrong\nplace.  The result is either a write into freed slab memory or a\npacket leaving with a checksum that does not match its payload.\n\nFix by re-deriving th from skb-\u003edata + protoff immediately after\nskb_ensure_writable() succeeds, so the subsequent checksum update\ntargets the linear, writable header."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - The bug is triggered when remote TCP packets traverse SYNPROXY netfilter hooks (NF_INET_LOCAL_IN / NF_INET_POST_ROUTING) on a host with SYNPROXY configured, which is the standard internet-facing firewall/router deployment for this subsystem.\nAC:L - An attacker who controls a TCP session through SYNPROXY can reliably send timestamp-bearing packets to hit the vulnerable path; the stale-pointer UAF write occurs whenever skb_ensure_writable() must expand a cloned skb, which the attacker can influence by sustaining traffic on the proxied connection.\nPR:N - Exploitation requires only that the victim already runs SYNPROXY (normal for protected services); the remote attacker needs no credentials or local privileges on the target system to send the triggering TCP packets.\nUI:N - No victim user action is required beyond normal network operation; exploitation is fully automated via crafted or sustained TCP traffic through the SYNPROXY session.\nS:U - Impact is confined to kernel memory on the affected host running SYNPROXY; this is standard kernel privilege escalation/memory corruption, not a cross-VM or cross-security-boundary escape.\nC:H - The stale tcphdr pointer causes inet_proto_csum_replace4() to write into freed slab memory, a use-after-free class bug that can be leveraged for arbitrary kernel memory read via heap grooming techniques.\nI:H - The out-of-bounds write into freed slab memory via a stale tcphdr pointer is a use-after-free write primitive that can be developed into arbitrary kernel memory writes and local privilege escalation.\nA:H - Writing into freed slab memory can corrupt adjacent kernel objects and cause kernel oops, panic, or crash, and UAF conditions are inherently capable of destabilizing the system even during exploitation attempts."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:38:06.995Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c"
        },
        {
          "url": "https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04"
        },
        {
          "url": "https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc"
        },
        {
          "url": "https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7"
        },
        {
          "url": "https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf"
        },
        {
          "url": "https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e"
        },
        {
          "url": "https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1"
        }
      ],
      "title": "netfilter: synproxy: refresh tcphdr after skb_ensure_writable",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64007",
    "datePublished": "2026-07-19T14:56:23.049Z",
    "dateReserved": "2026-07-19T07:54:57.026Z",
    "dateUpdated": "2026-08-05T12:38:06.995Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64007",
      "date": "2026-09-29",
      "epss": "0.00514",
      "percentile": "0.41484"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/nf_synproxy_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "9902a1058992de5d95656b64a3bd95c077f7ba2c",
                    "status": "affected",
                    "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d3019c61799adc21811af4b521f11f3dc77f8e04",
                    "status": "affected",
                    "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "dd206819f210522579010d889d45a9530bb494bc",
                    "status": "affected",
                    "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "af2c22ccb1f621aff487ff47a040e38e058541e7",
                    "status": "affected",
                    "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "c7f945f7da097245a2f8ed7775ce48421047ee96",
                    "status": "affected",
                    "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f0fea2b6d5453a11ad11713bbf37561b9b3a7edf",
                    "status": "affected",
                    "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a91887a5b6ee4b98dfbf1db657ed2b879430149e",
                    "status": "affected",
                    "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "92170e6afe927ab2792a3f71902845789c8e31b1",
                    "status": "affected",
                    "version": "48b1de4c110a7afa4b85862f6c75af817db26fad",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/netfilter/nf_synproxy_core.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.12"
                  },
                  {
                    "lessThan": "3.12",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.259",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.210",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.176",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.143",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.93",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.12",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnetfilter: synproxy: refresh tcphdr after skb_ensure_writable\n\nsynproxy_tstamp_adjust() rewrites the TCP timestamp option in place\nand then patches the TCP checksum via inet_proto_csum_replace4() on\nthe caller-supplied tcphdr pointer.  Both ipv4_synproxy_hook() and\nipv6_synproxy_hook() obtain that pointer with skb_header_pointer()\nbefore calling in, so it may either alias skb-\u003ehead directly or\npoint at the caller\u0027s on-stack _tcph buffer.\n\nBetween obtaining the pointer and using it, the function calls\nskb_ensure_writable(skb, optend), which on a cloned or non-linear\nskb invokes pskb_expand_head() and frees the old skb-\u003ehead.  After\nthat point the cached th is stale:\n\n    caller (ipv[46]_synproxy_hook)\n      th = skb_header_pointer(skb, ..., \u0026_tcph)\n      synproxy_tstamp_adjust(skb, protoff, th, ...)\n        skb_ensure_writable(skb, optend)\n          pskb_expand_head()        /* kfree(old skb-\u003ehead) */\n        ...\n        inet_proto_csum_replace4(\u0026th-\u003echeck, ...)\n                                    /* writes into freed head, or\n                                       into the caller\u0027s stack copy\n                                       leaving the on-wire checksum\n                                       stale */\n\nThe option bytes are written through skb-\u003edata and are fine; only\nthe checksum update goes through th and so lands in the wrong\nplace.  The result is either a write into freed slab memory or a\npacket leaving with a checksum that does not match its payload.\n\nFix by re-deriving th from skb-\u003edata + protoff immediately after\nskb_ensure_writable() succeeds, so the subsequent checksum update\ntargets the linear, writable header."
          }
        ],
        "id": "CVE-2026-64007",
        "lastModified": "2026-07-30T14:51:20.077",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "NETWORK",
                "availabilityImpact": "HIGH",
                "baseScore": 9.8,
                "baseSeverity": "CRITICAL",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "NONE",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 3.9,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:40.407",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Awaiting Analysis"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-09-09T21:56:57+00:00",
      "cve": "CVE-2026-64007",
      "id": "CVE-2026-64007",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:fixed": "453",
      "product_status:known_affected": "126",
      "product_status:known_not_affected": "15",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64007.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-09-28T23:51:21Z",
      "cve": "CVE-2026-64007",
      "id": "CVE-2026-64007",
      "initial_release_date": "2026-07-21T13:01:41Z",
      "product_status:first_fixed": "133",
      "product_status:known_affected": "538",
      "product_status:known_not_affected": "67",
      "product_status:recommended": "374",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64007",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64007.json",
      "version": "15"
    }
  }
}

RHSA-2026:66000

Vulnerability from csaf_opensuse - Published: 2026-09-09 15:22 - Updated: 2026-09-29 16:54

Summary

Red Hat Security Advisory: kernel security update

Severity

Important

Scope

7 vulnerabilities in this advisory, including CVE-2026-64007.

CVE-2026-64007

A flaw was found in the Linux kernel's netfilter synproxy module. When handling TCP timestamp options, a stale pointer can be used after memory reallocation. This can result in memory corruption, where data is written to a freed memory area, or lead to packets being sent with an incorrect checksum. A remote attacker could potentially exploit this to cause system instability or network communication issues.

7.0 (High)


                
                  CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Fixed: 120 products

https://access.redhat.com/errata/RHSA-2026:66000

Open the full advisory

RLSA-2026:57252 (CVE-2026-43206)

Vulnerability from osv_rocky – Published: 2026-08-21 06:05 – Updated: 2026-09-04 06:12 – Source website

Summary

Important: kernel security, bug fix, and enhancement update

Details

The kernel packages contain the Linux kernel, the core of any Linux operating system.

Security Fix(es):

kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)
kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)
kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237)
kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)
kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)
kernel: ip6_gre: Use cached t->net in ip6erspan_changelink() (CVE-2026-46120)
kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)
kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)
kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)
kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)
kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)
kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)
kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)
kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)
kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)
kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)
kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)
kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)
kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)
kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)
kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)
kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)
kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)
kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)
kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)

Bug Fix(es) and Enhancement(s):

kernel 5.14.0-687.5.1.el9_8 breaks wifi when using FIPS (JIRA:Rocky Linux-181065)
vhost: reset the vring metadata cache on vring reconfiguration [rhel-9.8.z] (JIRA:Rocky Linux-224549)
cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-9.8.z] (JIRA:Rocky Linux-235811)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

7.8 (High)


                    
                      CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:57252	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2467135	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2467156	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2467202	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482113	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482124	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2482614	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492403	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492719	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492768	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492788	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2495941	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2495950	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502188	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502321	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502361	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502422	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502443	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502463	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502589	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2506790	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507042	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507135	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2507216	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2508504	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513373	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513470	REPORT
	https://access.redhat.com/errata/RHSA-2026:57252	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:9",
        "name": "kernel",
        "purl": "pkg:rpm/rocky-linux/kernel?distro=rocky-linux-9\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "BaseOS"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:5.14.0-687.41.1.el9_8"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:57252"
  },
  "details": "The kernel packages contain the Linux kernel, the core of any Linux operating system.\n\nSecurity Fix(es):\n\n* kernel: netfilter: nf_conntrack_h323: fix OOB read in decode_choice() (CVE-2026-43233)\n\n* kernel: drm/amdkfd: Fix out-of-bounds write in kfd_event_page_set() (CVE-2026-43206)\n\n* kernel: drm/amdgpu: Refactor amdgpu_gem_va_ioctl for Handling Last Fence Update and Timeline Management v4 (CVE-2026-43237)\n\n* kernel: udf: fix partition descriptor append bookkeeping (CVE-2026-45991)\n\n* kernel: drm/amdkfd: Fix watch_id bounds checking in debug address watch v2 (CVE-2026-45878)\n\n* kernel: ip6_gre: Use cached t-\u003enet in ip6erspan_changelink() (CVE-2026-46120)\n\n* kernel: sched/psi: fix race between file release and pressure write (CVE-2026-52991)\n\n* kernel: drm/amdkfd: Fix buffer overflow in SDMA queue checkpoint/restore on GFX11 (CVE-2026-53143)\n\n* kernel: drm/amd/display: Clamp VBIOS HDMI retimer register count to array size (CVE-2026-53136)\n\n* kernel: mm/huge_memory: update file PMD counter before folio_put() (CVE-2026-53189)\n\n* kernel: drm/amd/display: Use krealloc_array() in dal_vector_reserve() (CVE-2026-53329)\n\n* kernel: drm/i915/gem: Fix phys BO pread/pwrite with offset (CVE-2026-53356)\n\n* kernel: drm/amdgpu: zero-initialize GART table on allocation (CVE-2026-53374)\n\n* kernel: drm/i915: Fix potential UAF in TTM object purge (CVE-2026-63884)\n\n* kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)\n\n* kernel: memfd: deny writeable mappings when implying SEAL_WRITE (CVE-2026-63952)\n\n* kernel: scsi: target: iscsi: Fix CRC overread and double-free in iscsit_handle_text_cmd() (CVE-2026-63888)\n\n* kernel: drm/amdgpu: fix amdgpu_hmm_range_get_pages (CVE-2026-63879)\n\n* kernel: net/smc: reject CHID-0 ACCEPT that matches an empty ism_dev slot (CVE-2026-64048)\n\n* kernel: drm/amd/display: Validate payload length and link_index in dc_process_dmub_aux_transfer_async (CVE-2026-64219)\n\n* kernel: smb: client: fix double-free in SMB2_open() replay (CVE-2026-64382)\n\n* kernel: smb: client: mask server-provided mode to 07777 in modefromsid (CVE-2026-64379)\n\n* kernel: smb: client: fix query_info() replay double-free (CVE-2026-64386)\n\n* kernel: posix-cpu-timers: Prevent UAF caused by non-leader exec() race (CVE-2026-64560)\n\n* kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)\n\n* kernel: smb/client: handle overlapping allocated ranges in fallocate (CVE-2026-68388)\n\nBug Fix(es) and Enhancement(s):\n\n* kernel 5.14.0-687.5.1.el9_8 breaks wifi when using FIPS  (JIRA:Rocky Linux-181065)\n\n* vhost: reset the vring metadata cache on vring reconfiguration [rhel-9.8.z] (JIRA:Rocky Linux-224549)\n\n* cifs: smb1 directory listings from xp server returning EINVAL and EIO [rhel-9.8.z] (JIRA:Rocky Linux-235811)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:57252",
  "modified": "2026-09-04T06:12:41.194796Z",
  "published": "2026-08-21T06:05:24.924335Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:57252"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467135"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467156"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2467202"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482113"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482124"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482614"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492403"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492719"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492768"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492788"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495941"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2495950"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502188"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502321"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502361"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502422"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502443"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502463"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502589"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2506790"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507042"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507135"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507216"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2508504"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513373"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513470"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:57252"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel security, bug fix, and enhancement update",
  "upstream": [
    "CVE-2026-43206",
    "CVE-2026-43233",
    "CVE-2026-43237",
    "CVE-2026-45878",
    "CVE-2026-45991",
    "CVE-2026-46120",
    "CVE-2026-52991",
    "CVE-2026-53136",
    "CVE-2026-53143",
    "CVE-2026-53189",
    "CVE-2026-53329",
    "CVE-2026-53356",
    "CVE-2026-53374",
    "CVE-2026-63879",
    "CVE-2026-63884",
    "CVE-2026-63888",
    "CVE-2026-63952",
    "CVE-2026-64007",
    "CVE-2026-64048",
    "CVE-2026-64219",
    "CVE-2026-64379",
    "CVE-2026-64382",
    "CVE-2026-64386",
    "CVE-2026-64560",
    "CVE-2026-68343",
    "CVE-2026-68388"
  ]
}

RLSA-2026:64770 (CVE-2026-43493)

Vulnerability from osv_rocky – Published: 2026-09-09 06:02 – Updated: 2026-09-23 06:12 – Source website

Summary

Important: kernel-rt security update

Details

The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.

Security Fix(es):

kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)
kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)
kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)
kernel: rhashtable: clear stale iter->p on table restart (CVE-2026-64563)
kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)
kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)
kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)

For more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.

Severity

8.1 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

Credits

Rocky Enterprise Software Foundation

Red Hat

References

URL

Type

	https://errata.rockylinux.org/RLSA-2026:64770	ADVISORY
	https://bugzilla.redhat.com/show_bug.cgi?id=2479812	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2492329	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2502361	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2510892	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2513373	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2516731	REPORT
	https://bugzilla.redhat.com/show_bug.cgi?id=2517046	REPORT
	https://access.redhat.com/errata/RHSA-2026:64770	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "package": {
        "ecosystem": "Rocky Linux:8",
        "name": "kernel-rt",
        "purl": "pkg:rpm/rocky-linux/kernel-rt?distro=rocky-linux-8\u0026epoch=0"
      },
      "ranges": [
        {
          "database_specific": {
            "yum_repository": "NFV"
          },
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "0:4.18.0-553.160.1.rt7.501.el8_10"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "credits": [
    {
      "name": "Rocky Enterprise Software Foundation"
    },
    {
      "name": "Red Hat"
    }
  ],
  "database_specific": {
    "license": "CC-BY-4.0",
    "license_url": "https://creativecommons.org/licenses/by/4.0/",
    "source_advisory": "RHSA-2026:64770"
  },
  "details": "The kernel-rt packages provide the Real Time Linux Kernel, which enables fine-tuning for systems with extremely high determinism requirements.\n\nSecurity Fix(es):\n\n* kernel: crypto: pcrypt - Fix handling of MAY_BACKLOG requests (CVE-2026-43493)\n\n* kernel: netfilter: conntrack: remove sprintf usage (CVE-2026-53002)\n\n* kernel: netfilter: synproxy: refresh tcphdr after skb_ensure_writable (CVE-2026-64007)\n\n* kernel: rhashtable: clear stale iter-\u003ep on table restart (CVE-2026-64563)\n\n* kernel: smb: client: validate DFS referral PathConsumed (CVE-2026-68343)\n\n* kernel: nvmet-rdma: handle inline data with a nonzero offset (CVE-2026-72129)\n\n* kernel: net: bridge: stop fast-leave after deleting a port group (CVE-2026-74480)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
  "id": "RLSA-2026:64770",
  "modified": "2026-09-23T06:12:45.411363Z",
  "published": "2026-09-09T06:02:22.608167Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://errata.rockylinux.org/RLSA-2026:64770"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2479812"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2492329"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502361"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2510892"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2513373"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2516731"
    },
    {
      "type": "REPORT",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2517046"
    },
    {
      "type": "ADVISORY",
      "url": "https://access.redhat.com/errata/RHSA-2026:64770"
    }
  ],
  "schema_version": "1.7.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Important: kernel-rt security update",
  "upstream": [
    "CVE-2026-43493",
    "CVE-2026-53002",
    "CVE-2026-64007",
    "CVE-2026-64563",
    "CVE-2026-68343",
    "CVE-2026-72129",
    "CVE-2026-74480"
  ]
}

SUSE-SU-2026:23477-1

Vulnerability from csaf_suse - Published: 2026-09-08 12:54 - Updated: 2026-09-29 08:19

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64007.

CVE-2026-64007

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 4 products

Open the full advisory

SUSE-SU-2026:23481-1

Vulnerability from csaf_suse - Published: 2026-09-08 13:00 - Updated: 2026-09-29 08:19

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64007.

CVE-2026-64007

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 11 products

Open the full advisory

SUSE-SU-2026:23528-1

Vulnerability from csaf_suse - Published: 2026-09-08 10:34 - Updated: 2026-09-29 08:19

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64007.

CVE-2026-64007

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 7 products

Open the full advisory

SUSE-SU-2026:23529-1

Vulnerability from csaf_suse - Published: 2026-09-08 11:00 - Updated: 2026-09-29 08:19

Summary

Security update for the Linux Kernel

Severity

Important

Scope

588 vulnerabilities in this advisory, including CVE-2026-64007.

CVE-2026-64007

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 17 products

Open the full advisory

SUSE-SU-2026:4120-1

Vulnerability from csaf_suse - Published: 2026-09-10 09:31 - Updated: 2026-09-29 08:20

Summary

Security update for the Linux Kernel

Severity

Important

Scope

662 vulnerabilities in this advisory, including CVE-2026-64007.

CVE-2026-64007

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 19 products

Open the full advisory

SUSE-SU-2026:4279-1

Vulnerability from csaf_suse - Published: 2026-09-22 08:32 - Updated: 2026-09-29 08:21

Summary

Security update for the Linux Kernel

Severity

Important

Scope

101 vulnerabilities in this advisory, including CVE-2026-64007.

CVE-2026-64007

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 4 products

Open the full advisory

SUSE-SU-2026:4282-1

Vulnerability from csaf_suse - Published: 2026-09-22 08:34 - Updated: 2026-09-29 08:21

Summary

Security update for the Linux Kernel

Severity

Important

Scope

234 vulnerabilities in this advisory, including CVE-2026-64007.

CVE-2026-64007

7.8 (High)


                
                  CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Recommended: 164 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-64007 (GCVE-0-2026-64007)

RLSA-2026:57252 (CVE-2026-43206)

RLSA-2026:64770 (CVE-2026-43493)

Tags

Sightings

Nomenclature

Related by attack behaviour