CVE-2026-64422 net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
A local attacker can trigger an integer overflow in TCP MTU probing by setting specific sysctl values, leading to an out-of-bounds read and potential denial of service.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64422?
CVE-2026-64422 is a high-severity vulnerability in Linux kernel, published on 25 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes
Reject invalid `net.ipv4.tcp_reordering` values before they reach TCP socket state. The sysctl is stored as an `int` but copied into the `u32` `tp->reordering` field for new sockets, so negative writes wrap to large values.
With `tcp_mtu_probing=2`, the wrapped value can overflow the `tcp_mtu_probe()` size calculation and drive the MTU probing path into an out-of-bounds read. Route `tcp_reordering` writes through `proc_dointvec_minmax()` and require it to be at least 1. Also require `tcp_max_reordering` to be at least 1 so the configured maximum cannot become negative either.
When registering the table for a non-init network namespace, relocate `extra2` pointers that refer into `init_net.ipv4` so the `tcp_reordering` upper bound follows that namespace's `tcp_max_reordering`.
Harden `tcp_mtu_probe()` itself by computing `size_needed` as `u64`. This keeps the send queue and window checks from being bypassed through signed integer overflow.
Weakness: CWE-190
Which versions are affected by CVE-2026-64422?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64422?
Apply the vendor's patch.
Is CVE-2026-64422 being exploited?
There is no known exploitation of CVE-2026-64422 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as AZL-93581, BELL-CVE-2026-64422, DEBIAN-CVE-2026-64422, GHSA-gwmg-q555-3325, ROOT-OS-DEBIAN-12-CVE-2026-64422, ROOT-OS-UBUNTU-2204-CVE-2026-64422 and 1 more.