CVE-2026-64518 tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().

Not scored Published 25 Jul 2026 Updated 25 Jul 2026

Out-of-bounds memory access in the Linux kernel TCP stack allows remote attackers to cause denial of service or potentially execute code.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2026-64518?

CVE-2026-64518 is a memory corruption vulnerability in Linux, published on 25 Jul 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In the Linux kernel, the following vulnerability has been resolved:

tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().

lockdep_sock_is_held() was added in tcp_ao_established_key() by the cited commit.

It can be called from tcp_v[46]_timewait_ack() with twsk.

Since it does not have sk->sk_lock, the lockdep annotation results in out-of-bound access.

$ pahole -C tcp_timewait_sock vmlinux | grep size /* size: 288, cachelines: 5, members: 8 */ $ pahole -C sock vmlinux | grep sk_lock socket_lock_t sk_lock; /* 440 192 */

Let's not use lockdep_sock_is_held() for TCP_TIME_WAIT.

Which versions are affected by CVE-2026-64518?

How do I fix CVE-2026-64518?

Apply the vendor's patch.

Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.

Is CVE-2026-64518 being exploited?

There is no known exploitation of CVE-2026-64518 in the wild and no public exploit code.

Sources

Also known as BELL-CVE-2026-64518, DEBIAN-CVE-2026-64518, GHSA-mfg2-ph7g-pf6h, ROOT-OS-UBUNTU-2204-CVE-2026-64518, UBUNTU-CVE-2026-64518.