CVE-2026-64518
Description
In the Linux kernel, the following vulnerability has been resolved: tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key(). lockdep_sock_is_held() was added in tcp_ao_established_key() by the cited commit. It can be called from tcp_v[46]_timewait_ack() with twsk. Since it does not have sk->sk_lock, the lockdep annotation results in out-of-bound access. $ pahole -C tcp_timewait_sock vmlinux | grep size /* size: 288, cachelines: 5, members: 8 */ $ pahole -C sock vmlinux | grep sk_lock socket_lock_t sk_lock; /* 440 192 */ Let's not use lockdep_sock_is_held() for TCP_TIME_WAIT.
How to fix
- Linux Linux87bb3e719042f0030a6dad39118c6a6b2a491ad9, 510db031ba6eb40134f84c90ef963ea4b6dfb878, 29cf64d128c94cf98d1c69d8b2962d39db5ff4c6, 03cb001ef87b3f8d859cf7f96329acf3d6235d29, 6.12.92 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | 051f49d5176613dea88ecf73a101c3a99f4720e9 ≤ v < 87bb3e719042f0030a6dad39118c6a6b2a491ad9, 6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6 ≤ v < 510db031ba6eb40134f84c90ef963ea4b6dfb878, 6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6 ≤ v < 29cf64d128c94cf98d1c69d8b2962d39db5ff4c6, 6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6 ≤ v < 03cb001ef87b3f8d859cf7f96329acf3d6235d29, 6.12.5 ≤ v < 6.12.92, 6.13 | 87bb3e719042f0030a6dad39118c6a6b2a491ad9, 510db031ba6eb40134f84c90ef963ea4b6dfb878, 29cf64d128c94cf98d1c69d8b2962d39db5ff4c6, 03cb001ef87b3f8d859cf7f96329acf3d6235d29, 6.12.92 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.