Executive brief
A vulnerability in the Linux kernel's networking component could allow a local user with administrative privileges to cause a system crash or access restricted memory. By providing invalid values to specific network configuration settings (TCP reordering), an attacker can trigger an out-of-bounds memory read. This primarily impacts the stability and availability of the affected system.
Technical details
A vulnerability exists in the Linux kernel's IPv4 implementation where 'net.ipv4.tcp_reordering' sysctl writes are not properly bounded. The sysctl value is stored as a signed integer but copied into an unsigned 32-bit field ('tp->reordering') for new sockets, causing negative values to wrap into extremely large positive values. When 'tcp_mtu_probing' is enabled, this wrapped value can cause an integer overflow in the 'tcp_mtu_probe()' size calculation, leading to an out-of-bounds read. The fix introduces 'proc_dointvec_minmax()' to enforce a minimum value of 1 for both 'tcp_reordering' and 'tcp_max_reordering' and hardens 'tcp_mtu_probe()' by using 64-bit integers for size calculations.
Affected products
- Linux Linux Kernel 91cc17c0e5e5 to f0d88a4cd03affff6c08adf6c63964e235aede43
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory
References
- https://git.kernel.org/stable/c/27ddf4486c7dbf5bdd393fa8bef6b67179796d98
- https://git.kernel.org/stable/c/782708ca1ea1f68b8cbb5ea3a7f5f18d0000efae
- https://git.kernel.org/stable/c/99206ce2244f8a3ed64298d0667c9055845a5dc7
- https://git.kernel.org/stable/c/a094ac95d3b69adfa1676eb9c8eae6835d4f1671
- https://git.kernel.org/stable/c/bbae351c0f32f7c200249e4aa6561b2b419dcf69
- https://git.kernel.org/stable/c/e81f805824a8109504fce090641b17d135b48cd1
- https://git.kernel.org/stable/c/efb8763d7bbb40cff4cc55a6b62c3095a038149c