Executive brief
A vulnerability in the Linux kernel's networking stack could allow an attacker to predict Initial Sequence Numbers (ISNs) for new TCP connections. This occurs because the system sometimes fails to clear temporary connection data after a packet is dropped, causing the next connection to reuse that data. While difficult to exploit, this could potentially allow an attacker to spoof or hijack network traffic.
Technical details
A vulnerability in the Linux kernel's TCP stack arises from the use of a per-CPU variable (tcp_tw_isn) to store TIME_WAIT-derived Initial Sequence Numbers. The kernel assumes this value will be consumed by tcp_conn_request(); however, if a packet is dropped (e.g., via TTL checks, XFRM policy, or eBPF filters) before reaching that function, the variable is not cleared. A subsequent SYN packet processed on the same CPU may then consume this stale, non-zero ISN, leading to predictable sequence numbers. This violates the expected randomness of ISNs and could facilitate session hijacking or spoofing. The fix migrates the storage of this value back to the socket buffer control block (skb->cb[]).
Affected products
- Linux Linux 6.10, 6.18.34, 7.0.11
Timeline
- 2026-05-19: disclosed: Initial patch submitted by Eric Dumazet
- 2026-07-19: advisory: CVE-2026-64024 published