Use-after-free in Linux kernel - CVE-2026-64007

Vulnerability identifier: #VU138637

CSH Severity: High

CVSS v4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-64007

CWE-ID: CWE-416

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to cause memory corruption or a denial of service.

The vulnerability exists due to a use-after-free in synproxy_tstamp_adjust() in the netfilter synproxy implementation when processing crafted TCP packets that trigger header rewriting on a cloned or non-linear skb. A remote attacker can send a specially crafted packet to cause memory corruption or a denial of service.

The issue affects checksum updates after the packet buffer is made writable, which can result in a write to freed slab memory or a transmitted packet with a stale checksum.

Linux kernel
openEuler
Ubuntu
kernel-debuginfo
python3-perf-debuginfo
python3-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools-debuginfo
kernel-tools
kernel-source
kernel-headers
kernel-devel
kernel-debugsource
bpftool-debuginfo
bpftool
kernel
linux-ibm (Ubuntu package)
linux-aws (Ubuntu package)
linux-azure (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-debuginfo - update to 5.10.0-330.0.0.231
python3-perf-debuginfo - update to 5.10.0-330.0.0.231
python3-perf - update to 5.10.0-330.0.0.231
perf-debuginfo - update to 5.10.0-330.0.0.231
perf - update to 5.10.0-330.0.0.231
kernel-tools-devel - update to 5.10.0-330.0.0.231
kernel-tools-debuginfo - update to 5.10.0-330.0.0.231
kernel-tools - update to 5.10.0-330.0.0.231
kernel-source - update to 5.10.0-330.0.0.231
kernel-headers - update to 5.10.0-330.0.0.231
kernel-devel - update to 5.10.0-330.0.0.231
kernel-debugsource - update to 5.10.0-330.0.0.231
bpftool-debuginfo - update to 5.10.0-330.0.0.231
bpftool - update to 5.10.0-330.0.0.231
kernel - update to 5.10.0-330.0.0.231
linux-ibm (Ubuntu package) - addressed in versions 7.0.0-1008.8, 7.0.0-1010.10
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15
linux-azure (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1010.10
linux-nvidia (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1016.16~24.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

• https://git.kernel.org/stable/c/92170e6afe927ab2792a3f71902845789c8e31b1
• https://git.kernel.org/stable/c/9902a1058992de5d95656b64a3bd95c077f7ba2c
• https://git.kernel.org/stable/c/a91887a5b6ee4b98dfbf1db657ed2b879430149e
• https://git.kernel.org/stable/c/af2c22ccb1f621aff487ff47a040e38e058541e7
• https://git.kernel.org/stable/c/c7f945f7da097245a2f8ed7775ce48421047ee96
• https://git.kernel.org/stable/c/d3019c61799adc21811af4b521f11f3dc77f8e04
• https://git.kernel.org/stable/c/dd206819f210522579010d889d45a9530bb494bc
• https://git.kernel.org/stable/c/f0fea2b6d5453a11ad11713bbf37561b9b3a7edf

• Use-after-free in Linux kernel netfilter
• Ubuntu update for linux-ibm
• Ubuntu update for linux-azure
• Ubuntu update for linux-aws
• Ubuntu update for linux-nvidia-bos
• Ubuntu update for linux-nvidia
• openEuler 22.03 LTS SP4 update for kernel