SB20260727140 - Out-of-bounds read in Linux kernel ipv4
Published: July 27, 2026
Security Bulletin ID
SB20260727140
CSH Severity
Low
Patch available
YES
Number of vulnerabilities
1
Exploitation vector
Local access
Highest impact
Information disclosure
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 1 vulnerability.
1) Out-of-bounds read (CVE-ID: CVE-2026-64422)
CWE-ID: CWE-125 - Out-of-bounds read
CVSSv4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
The vulnerability allows a local user to disclose sensitive information.
The vulnerability exists due to an out-of-bounds read in tcp_mtu_probe() when processing an invalid net.ipv4.tcp_reordering value during MTU probing. A local user can write a negative tcp_reordering value to trigger the out-of-bounds read and disclose sensitive information.
Exploitation requires tcp_mtu_probing to be set to 2.
Remediation
Install update from vendor's website.
References
- https://git.kernel.org/stable/c/27ddf4486c7dbf5bdd393fa8bef6b67179796d98
- https://git.kernel.org/stable/c/782708ca1ea1f68b8cbb5ea3a7f5f18d0000efae
- https://git.kernel.org/stable/c/99206ce2244f8a3ed64298d0667c9055845a5dc7
- https://git.kernel.org/stable/c/a094ac95d3b69adfa1676eb9c8eae6835d4f1671
- https://git.kernel.org/stable/c/bbae351c0f32f7c200249e4aa6561b2b419dcf69
- https://git.kernel.org/stable/c/e81f805824a8109504fce090641b17d135b48cd1
- https://git.kernel.org/stable/c/efb8763d7bbb40cff4cc55a6b62c3095a038149c
- https://git.kernel.org/stable/c/f0d88a4cd03affff6c08adf6c63964e235aede43