Out-of-Bounds Access in Linux Kernel TCP Implementation

CVE-2026-64518

What is CVE-2026-64518?

A vulnerability was identified in the Linux kernel's TCP implementation related to improper handling of socket locks during the state transition of TCP connections. The tcp_ao_established_key() function lacked proper locking mechanisms, which led to potential out-of-bounds access when called from the tcp_v[46]_timewait_ack() function. This vulnerability could compromise the stability and security of network communications if exploited, making it essential for users to update their systems to the latest version where this issue has been addressed.

References