CVE-2026-64422

A flaw was found in the Linux kernel's IPv4 networking stack. Invalid values for net.ipv4.tcp_reordering, particularly negative inputs, can lead to an integer overflow when processed. When tcp_mtu_probing is enabled, this overflow can cause an out-of-bounds read within the tcp_mtu_probe() function. This vulnerability may allow an attacker to access sensitive information or cause system instability.

A signed integer handling bug in net.ipv4.tcp_reordering can let a negative sysctl value wrap into a very large tp reordering value for new TCP sockets. With tcp_mtu_probing set to 2, this value can overflow the tcp_mtu_probe size_needed calculation and bypass send queue or window checks, driving the TCP MTU probing path into an OOB read. For the CVSS the PR:L is used because triggering can be possible for a local user or process that can write the per namespace TCP sysctl through CAP_NET_ADMIN or a user controlled network namespace. The issue is not directly network reachable because the attacker must first control local TCP sysctl state, but a controlled TCP connection may be used to exercise the vulnerable output path. Impact is at least local denial of service via kernel crash and in the paranoid case may include high confidentiality impact because the primitive is an OOB read in a packet output path.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.