Linux Kernel up to 6.18.16/6.19.6/7.0-rc2 tcp siphash downgrade

Summaryinfo

A vulnerability labeled as problematic has been found in Linux Kernel up to 6.18.16/6.19.6/7.0-rc2. The affected element is the function siphash of the component tcp. The manipulation results in downgrade. This vulnerability is reported as CVE-2026-23247. The attack can be launched remotely. No exploit exists. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as problematic has been found in Linux Kernel up to 6.18.16/6.19.6/7.0-rc2. Affected is the function siphash of the component tcp. The manipulation with an unknown input leads to a downgrade vulnerability. CWE is classifying the issue as CWE-757. A protocol or its implementation supports interaction between multiple actors and allows those actors to negotiate which algorithm should be used as a protection mechanism such as encryption or authentication, but it does not select the strongest algorithm that is available to both parties. This is going to have an impact on confidentiality. CVE summarizes:

In the Linux kernel, the following vulnerability has been resolved: tcp: secure_seq: add back ports to TS offset This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets") tcp_tw_recycle went away in 2017. Zhouyan Deng reported off-path TCP source port leakage via SYN cookie side-channel that can be fixed in multiple ways. One of them is to bring back TCP ports in TS offset randomization. As a bonus, we perform a single siphash() computation to provide both an ISN and a TS offset.

The advisory is available at git.kernel.org. This vulnerability is traded as CVE-2026-23247 since 01/13/2026. The exploitability is told to be difficult. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details are known, but there is no available exploit. The structure of the vulnerability defines a possible price range of USD $0-$5k at the moment (estimation calculated on 06/24/2026). This vulnerability is assigned to T1562.010 by the MITRE ATT&CK project.

The vulnerability scanner Nessus provides a plugin with the ID 302908 (Linux Distros Unpatched Vulnerability : CVE-2026-23247), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 6.18.17, 6.19.7 or 7.0-rc3 eliminates this vulnerability. Applying the patch eae2f14ab2efccdb7480fae7d42c4b0116ef8805/46e5b0d7cf55821527adea471ffe52a5afbd9caf/165573e41f2f66ef98940cf65f838b2cb575d9d1 is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The best possible mitigation is suggested to be upgrading to the latest version.

The vulnerability is also documented in the databases at Tenable (302908), EUVD (EUVD-2026-12810) and CERT Bund (WID-SEC-2026-0774). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Affected

• Google Container-Optimized OS
• Debian Linux
• Amazon Linux 2
• Red Hat Enterprise Linux
• SUSE Linux
• Oracle Linux
• SUSE openSUSE
• RESF Rocky Linux
• Open Source Linux Kernel

Productinfo

Type

• Operating System

Vendor

• Linux

Name

• Kernel

Version

• 6.18.0
• 6.18.1
• 6.18.2
• 6.18.3
• 6.18.4
• 6.18.5
• 6.18.6
• 6.18.7
• 6.18.8
• 6.18.9
• 6.18.10
• 6.18.11
• 6.18.12
• 6.18.13
• 6.18.14
• 6.18.15
• 6.18.16
• 6.19.0
• 6.19.1
• 6.19.2
• 6.19.3
• 6.19.4
• 6.19.5
• 6.19.6
• 7.0-rc1
• 7.0-rc2

License

• open-source

Website

• Vendor: https://www.kernel.org/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion