CVE-2026-64024: tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

tcp: fix stale per-CPU tcp_tw_isn leak enabling ISN prediction

Blamed commit moved the TIME_WAIT-derived ISN from the skb control
block to a per-CPU variable, assuming the value would always be consumed
by tcp_conn_request() for the same packet that wrote it. That assumption
is violated by multiple drop paths between the producer
(__this_cpu_write(tcp_tw_isn, isn) in tcp_v{4,6}_rcv()) and the consumer
(tcp_conn_request()):

 - min_ttl / min_hopcount check
 - xfrm policy check
 - tcp_inbound_hash() MD5/AO mismatch
 - tcp_filter() eBPF/SO_ATTACH_FILTER drop
 - th->syn && th->fin discard in tcp_rcv_state_process() TCP_LISTEN
 - psp_sk_rx_policy_check() in tcp_v{4,6}_do_rcv()
 - tcp_checksum_complete() in tcp_v{4,6}_do_rcv()
 - tcp_v{4,6}_cookie_check() returning NULL

When a packet is dropped on any of these paths, tcp_tw_isn is left set.

The next SYN processed on the same CPU then consumes the non zero value in
tcp_conn_request(), receiving a potentially predictable ISN.

This patch moves back tcp_tw_isn to skb->cb[], getting rid of the per-cpu
variable.

Note that tcp_v{4,6}_fill_cb() do not set it.

Very litle impact on overall code size/complexity:

$ scripts/bloat-o-meter -t vmlinux.old vmlinux.new
add/remove: 0/0 grow/shrink: 2/1 up/down: 8/-15 (-7)
Function                                     old     new   delta
tcp_v6_rcv                                  3038    3042      +4
tcp_v4_rcv                                  3035    3039      +4
tcp_conn_request                            2938    2923     -15
Total: Before=24436060, After=24436053, chg -0.00%

The Linux kernel CVE team has assigned CVE-2026-64024 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.10 with commit 41eecbd712b73f0d5dcf1152b9a1c27b1f238028 and fixed in 6.18.34 with commit e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd
	Issue introduced in 6.10 with commit 41eecbd712b73f0d5dcf1152b9a1c27b1f238028 and fixed in 7.0.11 with commit 4affe063fa56c880cbea8d0bfded0bb80751579d
	Issue introduced in 6.10 with commit 41eecbd712b73f0d5dcf1152b9a1c27b1f238028 and fixed in 7.1 with commit 1bbf0ced1d9db73ac7893c2187f3459288603e0d

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64024
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	include/net/tcp.h
	net/ipv4/tcp.c
	net/ipv4/tcp_input.c
	net/ipv4/tcp_ipv4.c
	net/ipv6/tcp_ipv6.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/e47f7060eaf60894e3e4d0e3c4fe6e1f2eacfbdd
	https://git.kernel.org/stable/c/4affe063fa56c880cbea8d0bfded0bb80751579d
	https://git.kernel.org/stable/c/1bbf0ced1d9db73ac7893c2187f3459288603e0d