Executive brief
A vulnerability in the Linux kernel's networking stack could allow an attacker to identify active network ports that should otherwise be hidden. This occurs due to a weakness in how the system generates secure sequence numbers and timestamps for TCP connections. While primarily a technical information leak, it could be used by an attacker to map out network services or disrupt communications.
Technical details
An off-path TCP source port leakage vulnerability exists in the Linux kernel's TCP implementation. The issue stems from a previous change that downgraded timestamp (TS) offsets to per-host randomization rather than per-connection (including ports). This created a side-channel via SYN cookies that allows an attacker to infer source ports. The fix reverts the problematic change and re-incorporates TCP ports into the TS offset randomization using a single siphash() computation for both the Initial Sequence Number (ISN) and the TS offset. This prevents the side-channel leakage while maintaining performance.
Affected products
- Linux Linux Kernel 6.19 to 6.19.7, 4.11 to 6.18.17
Timeline
- 2026-03-02: patched: Initial patch authored by Eric Dumazet
- 2026-03-18: disclosed: CVE published