{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.176-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.94-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.12-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  netfilter: synproxy: refresh tcphdr after skb_ensure_writable  synproxy_tstamp_adjust() rewrites the TCP timestamp option in place and then patches the TCP checksum via inet_proto_csum_replace4() on the caller-supplied tcphdr pointer.  Both ipv4_synproxy_hook() and ipv6_synproxy_hook() obtain that pointer with skb_header_pointer() before calling in, so it may either alias skb-\u003ehead directly or point at the caller's on-stack _tcph buffer.  Between obtaining the pointer and using it, the function calls skb_ensure_writable(skb, optend), which on a cloned or non-linear skb invokes pskb_expand_head() and frees the old skb-\u003ehead.  After that point the cached th is stale:      caller (ipv[46]_synproxy_hook)       th = skb_header_pointer(skb, ..., \u0026_tcph)       synproxy_tstamp_adjust(skb, protoff, th, ...)         skb_ensure_writable(skb, optend)           pskb_expand_head()        /* kfree(old skb-\u003ehead) */         ...         inet_proto_csum_replace4(\u0026th-\u003echeck, ...)                                     /* writes into freed head, or                                        into the caller's stack copy                                        leaving the on-wire checksum                                        stale */  The option bytes are written through skb-\u003edata and are fine; only the checksum update goes through th and so lands in the wrong place.  The result is either a write into freed slab memory or a packet leaving with a checksum that does not match its payload.  Fix by re-deriving th from skb-\u003edata + protoff immediately after skb_ensure_writable() succeeds, so the subsequent checksum update targets the linear, writable header.",
  "id": "DEBIAN-CVE-2026-64007",
  "modified": "2026-09-14T16:47:44.730316714Z",
  "published": "2026-07-19T16:17:40.407Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64007"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-64007"
  ]
}