CVE-2026-64422: net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes

Reject invalid `net.ipv4.tcp_reordering` values before they reach TCP
socket state. The sysctl is stored as an `int` but copied into the
`u32` `tp->reordering` field for new sockets, so negative writes wrap
to large values.

With `tcp_mtu_probing=2`, the wrapped value can overflow the
`tcp_mtu_probe()` size calculation and drive the MTU probing path into
an out-of-bounds read. Route `tcp_reordering` writes through
`proc_dointvec_minmax()` and require it to be at least 1. Also require
`tcp_max_reordering` to be at least 1 so the configured maximum cannot
become negative either.

When registering the table for a non-init network namespace, relocate
`extra2` pointers that refer into `init_net.ipv4` so the
`tcp_reordering` upper bound follows that namespace's
`tcp_max_reordering`.

Harden `tcp_mtu_probe()` itself by computing `size_needed` as `u64`.
This keeps the send queue and window checks from being bypassed through
signed integer overflow.

The Linux kernel CVE team has assigned CVE-2026-64422 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.24 with commit 91cc17c0e5e5ada156a8d5787a2509d263ea6bbf and fixed in 5.10.261 with commit f0d88a4cd03affff6c08adf6c63964e235aede43
	Issue introduced in 2.6.24 with commit 91cc17c0e5e5ada156a8d5787a2509d263ea6bbf and fixed in 5.15.212 with commit 27ddf4486c7dbf5bdd393fa8bef6b67179796d98
	Issue introduced in 2.6.24 with commit 91cc17c0e5e5ada156a8d5787a2509d263ea6bbf and fixed in 6.1.178 with commit 782708ca1ea1f68b8cbb5ea3a7f5f18d0000efae
	Issue introduced in 2.6.24 with commit 91cc17c0e5e5ada156a8d5787a2509d263ea6bbf and fixed in 6.6.145 with commit e81f805824a8109504fce090641b17d135b48cd1
	Issue introduced in 2.6.24 with commit 91cc17c0e5e5ada156a8d5787a2509d263ea6bbf and fixed in 6.12.96 with commit 99206ce2244f8a3ed64298d0667c9055845a5dc7
	Issue introduced in 2.6.24 with commit 91cc17c0e5e5ada156a8d5787a2509d263ea6bbf and fixed in 6.18.39 with commit bbae351c0f32f7c200249e4aa6561b2b419dcf69
	Issue introduced in 2.6.24 with commit 91cc17c0e5e5ada156a8d5787a2509d263ea6bbf and fixed in 7.1.4 with commit a094ac95d3b69adfa1676eb9c8eae6835d4f1671
	Issue introduced in 2.6.24 with commit 91cc17c0e5e5ada156a8d5787a2509d263ea6bbf and fixed in 7.2-rc1 with commit efb8763d7bbb40cff4cc55a6b62c3095a038149c

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64422
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	net/ipv4/sysctl_net_ipv4.c
	net/ipv4/tcp_output.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/f0d88a4cd03affff6c08adf6c63964e235aede43
	https://git.kernel.org/stable/c/27ddf4486c7dbf5bdd393fa8bef6b67179796d98
	https://git.kernel.org/stable/c/782708ca1ea1f68b8cbb5ea3a7f5f18d0000efae
	https://git.kernel.org/stable/c/e81f805824a8109504fce090641b17d135b48cd1
	https://git.kernel.org/stable/c/99206ce2244f8a3ed64298d0667c9055845a5dc7
	https://git.kernel.org/stable/c/bbae351c0f32f7c200249e4aa6561b2b419dcf69
	https://git.kernel.org/stable/c/a094ac95d3b69adfa1676eb9c8eae6835d4f1671
	https://git.kernel.org/stable/c/efb8763d7bbb40cff4cc55a6b62c3095a038149c