Executive brief
A vulnerability was identified in the Linux kernel's Netfilter SYNPROXY component, which is used to protect servers against SYN flood denial-of-service attacks. A technical error in how the system handles network packet headers could lead to memory corruption or the transmission of corrupted data packets. This could potentially impact the stability of the system or the reliability of network communications.
Technical details
A use-after-free vulnerability exists in the Linux kernel's netfilter synproxy core. The function synproxy_tstamp_adjust() maintains a pointer to the TCP header (tcphdr) obtained via skb_header_pointer(). However, it subsequently calls skb_ensure_writable(), which may invoke pskb_expand_head(), freeing the original skb->head and rendering the cached header pointer stale. Subsequent attempts to update the TCP checksum via the stale pointer result in writes to freed slab memory or updates to an on-stack buffer that do not reflect on the actual network packet. This affects both IPv4 and IPv6 synproxy hooks. The fix involves re-deriving the TCP header pointer immediately after the skb_ensure_writable() call.
Affected products
- Linux Linux Kernel netfilter synproxy component
Timeline
- 2026-05-19: other: Patch authored
- 2026-07-19: disclosed: CVE published
References
- https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1
- https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c
- https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e
- https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7
- https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96
- https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04
- https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc