Riskcovery

CVE-2026-64518

tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().

State
Published
Severity
Not scored
Published
Jul 25, 2026
Updated
Jul 25, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

tcp: Fix out-of-bounds access for twsk in tcp_ao_established_key().

lockdep_sock_is_held() was added in tcp_ao_established_key() by the cited commit.

It can be called from tcp_v[46]_timewait_ack() with twsk.

Since it does not have sk->sk_lock, the lockdep annotation results in out-of-bound access.

$ pahole -C tcp_timewait_sock vmlinux | grep size /* size: 288, cachelines: 5, members: 8 */ $ pahole -C sock vmlinux | grep sk_lock socket_lock_t sk_lock; /* 440 192 */

Let's not use lockdep_sock_is_held() for TCP_TIME_WAIT.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 051f49d5176613dea88ecf73a101c3a99f4720e9 to before 87bb3e719042f0030a6dad39118c6a6b2a491ad9Affected
  • 6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6 to before 510db031ba6eb40134f84c90ef963ea4b6dfb878Affected
  • 6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6 to before 29cf64d128c94cf98d1c69d8b2962d39db5ff4c6Affected
  • 6b2d11e2d8fc130df4708be0b6b53fd3e6b54cf6 to before 03cb001ef87b3f8d859cf7f96329acf3d6235d29Affected
  • 6.12.5 to before 6.12.92Affected
LinuxLinux
  • 6.13Affected
  • before 6.13Not affected
  • 6.12.92 through 6.12.*Not affected
  • 6.18.34 through 6.18.*Not affected
  • 7.0.11 through 7.0.*Not affected
  • 7.1 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.