CVE-2026-64518
- Source
- https://cve.org/CVERecord?id=CVE-2026-64518
- Import Source
- https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-64518.json
- JSON Data
- https://api.osv.dev/v1/vulns/CVE-2026-64518
- Downstream
- Published
- 2026-07-25T09:14:44Z
- Modified
- 2026-08-12T03:51:41Z
- Summary
- tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().
- Details
-
In the Linux kernel, the following vulnerability has been resolved:
tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().
lockdep_sock_is_held() was added in tcp_ao_established_key() by the cited commit.
It can be called from tcp_v[46]_timewait_ack() with twsk.
Since it does not have sk->sk_lock, the lockdep annotation results in out-of-bound access.
$ pahole -C tcp_timewait_sock vmlinux | grep size /* size: 288, cachelines: 5, members: 8 / $ pahole -C sock vmlinux | grep sk_lock socket_lock_t sk_lock; / 440 192 */
Let's not use lockdep_sock_is_held() for TCP_TIME_WAIT.
- Database specific
{ "cna_assigner": "Linux", "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64518.json" }- References
-
- https://git.kernel.org/stable/c/03cb001ef87b3f8d859cf7f96329acf3d6235d29
- https://git.kernel.org/stable/c/29cf64d128c94cf98d1c69d8b2962d39db5ff4c6
- https://git.kernel.org/stable/c/510db031ba6eb40134f84c90ef963ea4b6dfb878
- https://git.kernel.org/stable/c/87bb3e719042f0030a6dad39118c6a6b2a491ad9
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64518.json
- https://nvd.nist.gov/vuln/detail/CVE-2026-64518
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected packages
Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Affected ranges
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced051f49d5176613dea88ecf73a101c3a99f4720e9Fixed87bb3e719042f0030a6dad39118c6a6b2a491ad9
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6Fixed510db031ba6eb40134f84c90ef963ea4b6dfb878Fixed29cf64d128c94cf98d1c69d8b2962d39db5ff4c6Fixed03cb001ef87b3f8d859cf7f96329acf3d6235d29
- Type
- GIT
- Repo
- https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
- Events
-
Introduced6.12.5Fixed6.12.92
Affected versions
v6.*
v6.12.10
v6.12.11
v6.12.12
v6.12.13
v6.12.14
v6.12.15
v6.12.16
v6.12.17
v6.12.18
v6.12.19
v6.12.20
v6.12.21
v6.12.22
v6.12.23
v6.12.24
v6.12.25
v6.12.26
v6.12.27
v6.12.28
v6.12.29
v6.12.30
v6.12.31
v6.12.32
v6.12.33
v6.12.34
v6.12.35
v6.12.36
v6.12.37
v6.12.38
v6.12.39
v6.12.40
v6.12.41
v6.12.42
v6.12.43
v6.12.44
v6.12.45
v6.12.46
v6.12.47
v6.12.48
v6.12.49
v6.12.5
v6.12.50
v6.12.51
v6.12.52
v6.12.53
v6.12.54
v6.12.55
v6.12.56
v6.12.57
v6.12.58
v6.12.59
v6.12.6
v6.12.60
v6.12.61
v6.12.62
v6.12.63
v6.12.64
v6.12.65
v6.12.66
v6.12.67
v6.12.68
v6.12.69
v6.12.7
v6.12.70
v6.12.71
v6.12.72
v6.12.73
v6.12.74
v6.12.75
v6.12.76
v6.12.77
v6.12.78
v6.12.79
v6.12.8
v6.12.80
v6.12.81
v6.12.82
v6.12.83
v6.12.84
v6.12.85
v6.12.86
v6.12.87
v6.12.88
v6.12.89
v6.12.9
v6.12.90
v6.12.91