SB20260720207 - Race condition in Linux kernel ipv6

Description

This security bulletin contains information about 1 vulnerability.

1) Race condition (CVE-ID: CVE-2026-64024)

CWE-ID: CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CVSSv4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to predict TCP initial sequence numbers.

The vulnerability exists due to improper state management in the Linux kernel TCP input path when processing TCP packets that transition from TIME_WAIT handling and are later dropped before request processing. A remote attacker can send packets that trigger these drop paths and then send a subsequent SYN on the same CPU to predict TCP initial sequence numbers.

The issue occurs because a non-zero TIME_WAIT-derived ISN can remain stored after several packet-drop conditions, including policy, filter, checksum, and header validation failures.

Remediation

Install update from vendor's website.

References

• https://git.kernel.org/stable/c/1bbf0ced1d9db73ac7893c2187f3459288603e0d
• https://git.kernel.org/stable/c/4affe063fa56c880cbea8d0bfded0bb80751579d
• https://git.kernel.org/stable/c/e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd