Out-of-bounds read in Linux kernel - CVE-2026-64518

Vulnerability identifier: #VU139408

CSH Severity: Low

CVSS v4: 6.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2026-64518

CWE-ID: CWE-125

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a local attacker to cause a denial of service.

The vulnerability exists due to an out-of-bounds read in tcp_ao_established_key() when processing TCP_TIME_WAIT sockets from tcp_v[46]_timewait_ack(). A local attacker can trigger the vulnerable code path to cause a denial of service.

The issue occurs because the code may access sock locking state on a timewait socket that does not contain sk_lock.

Linux kernel
Ubuntu
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-gcp-7.0 (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
linux (Ubuntu package) - addressed in versions 6.8.0-139.139+fips1, 6.8.0-1049.53, 6.8.0-1062.65+fips1, 6.8.0-1062.65.1, 6.8.0-1062.65~22.04.1, 6.8.0-1062.70, 6.8.0-1064.68, 6.8.0-1067.75, 6.8.0-1067.75+fips1, 6.8.1-1059.60, 6.8.1-1059.60~22.04.1
linux-aws (Ubuntu package) - addressed in versions 7.0.0-1009.9, 7.0.0-1015.15
linux-gcp-7.0 (Ubuntu package) - update to 7.0.0-1011.11~24.04.1
linux-nvidia (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1016.16~24.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

• https://git.kernel.org/stable/c/03cb001ef87b3f8d859cf7f96329acf3d6235d29
• https://git.kernel.org/stable/c/29cf64d128c94cf98d1c69d8b2962d39db5ff4c6
• https://git.kernel.org/stable/c/510db031ba6eb40134f84c90ef963ea4b6dfb878
• https://git.kernel.org/stable/c/87bb3e719042f0030a6dad39118c6a6b2a491ad9

• Out-of-bounds read in Linux kernel ipv4
• Ubuntu update for linux-aws
• Ubuntu update for linux-nvidia-bos
• Ubuntu update for linux-nvidia
• Ubuntu update for linux
• Ubuntu update for linux-gcp-7.0