CVE-2026-64422

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the IPv4 implementation where invalid values assigned to the net.ipv4.tcp reordering sysctl are not properly rejected. Because this value is stored as an int but copied into a u32 field (tp->reordering), negative inputs wrap into very large positive values. When tcp mtu probing is set to 2, this wrapped value can cause an overflow during the size calculation in the tcp mtu probe() function, leading to an out-of-bounds read. Additionally, signed integer overflow in the tcp mtu probe() function could allow the bypass of send queue and window checks.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.