CVE-2026-64518

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds access occurs in the tcp ao established key() function when it is called from tcp v[46] timewait ack() using a twsk (TCP time-wait socket). This happens because the lockdep sock is held() function is used for lockdep annotation, but the tcp timewait sock structure lacks the sk lock member found in the standard sock structure, leading to memory access outside the allocated bounds of the structure.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.