Executive brief
A vulnerability was identified in the Linux kernel's networking component that could lead to an out-of-bounds memory access. This issue occurs during specific TCP connection states, potentially causing system instability or crashes. Patches have been released to correct how the kernel handles these internal socket structures.
Technical details
An out-of-bounds access vulnerability exists in net/ipv4/tcp_ao.c within the tcp_ao_established_key() function. The root cause is an improper lockdep annotation (lockdep_sock_is_held) being applied to timewait sockets (twsk), which do not contain the expected sk_lock member found in full socket structures. When called from tcp_v[46]_timewait_ack(), this results in memory access beyond the bounds of the timewait socket structure. The fix introduces a check using sk_fullsock(sk) to ensure the lockdep validation only runs on appropriate socket types. Fixes are available in stable branches including 6.12.92, 6.18.34, and 7.0.11.
Affected products
- Linux Linux Kernel 6.12.5 through 6.12.91, 6.13
Timeline
- 2026-05-08: other: Patch submitted by developer
- 2026-07-25: disclosed: CVE published