---
cve: "CVE-2026-64422"
severity: "HIGH"
cvss: 7.1
epss: "13%"
vendor: "Linux"
kev: false
exploited: false
published: "2026-07-25 10:17:26"
tags: [cve, security, high]
source: tsecurity.de CVE-Dossier
exported: "2026-09-06T19:21:52+02:00"
---

# CVE-2026-64422

> 7.1 HIGH

## Beschreibung

In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes

Reject invalid `net.ipv4.tcp_reordering` values before they reach TCP
socket state. The sysctl is stored as an `int` but copied into the
`u32` `tp->reordering` field for new sockets, so negative writes wrap
to large values.

With `tcp_mtu_probing=2`, the wrapped value can overflow the
`tcp_mtu_probe()` size calculation and drive the MTU probing path into
an out-of-bounds read. Route `tcp_reordering` writes through
`proc_dointvec_minmax()` and require it to be at least 1. Also require
`tcp_max_reordering` to be at least 1 so the configured maximum cannot
become negative either.

When registering the table for a non-init network namespace, relocate
`extra2` pointers that refer into `init_net.ipv4` so the
`tcp_reordering` upper bound follows that namespace's
`tcp_max_reordering`.

Harden `tcp_mtu_probe()` itself by computing `size_needed` as `u64`.
This keeps the send queue and window checks from being bypassed through
signed integer overflow.

## CVSS-Vektor

```
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
```

| Metrik | Wert | Bewertung |
|---|---|---|
| AV Angriffsvektor | Lokal | good |
| AC Komplexität | Gering | bad |
| PR Privilegien | Gering | warn |
| UI Interaktion | Keine | bad |
| S Scope | Unverändert | good |
| C Vertraulichkeit | Hoch | bad |
| I Integrität | Keine | good |
| A Verfügbarkeit | Hoch | bad |

## Patch verfügbar (OSV)

- Kernel ≥ 5.10.261
- Kernel ≥ 5.15.212
- Kernel ≥ 6.1.178
- Kernel ≥ 6.6.145
- Kernel ≥ 6.12.96
- Kernel ≥ 6.18.39
- Kernel ≥ 7.1.4

## Referenzen

- <https://git.kernel.org/stable/c/f0d88a4cd03affff6c08adf6c63964e235aede43>
- <https://git.kernel.org/stable/c/27ddf4486c7dbf5bdd393fa8bef6b67179796d98>
- <https://git.kernel.org/stable/c/782708ca1ea1f68b8cbb5ea3a7f5f18d0000efae>
- <https://git.kernel.org/stable/c/e81f805824a8109504fce090641b17d135b48cd1>
- <https://git.kernel.org/stable/c/99206ce2244f8a3ed64298d0667c9055845a5dc7>
- <https://git.kernel.org/stable/c/bbae351c0f32f7c200249e4aa6561b2b419dcf69>
- <https://git.kernel.org/stable/c/a094ac95d3b69adfa1676eb9c8eae6835d4f1671>
- <https://git.kernel.org/stable/c/efb8763d7bbb40cff4cc55a6b62c3095a038149c>

---
_Exportiert aus dem [tsecurity.de CVE-Dossier](https://tsecurity.de/cve?cve=CVE-2026-64422) · Datenquellen: EUVD (ENISA), NVD, OSV, CISA KEV, FIRST EPSS, Exploit-DB, BSI BITS_