CVE-2026-64459
A flaw in the Linux kernel’s TCP-AO handling can let an attacker crash the system by sending specially crafted packets. The bug was fixed by restoring an RCU grace period and moving a free operation to a deferred callback. The patch is already in the kernel source.
An official fix is available, so this entry is kept for 30 days and then removed automatically.
Who is affected
All Linux systems running kernel versions that contain the vulnerable TCP-AO code before the fix (any kernel that lacks the commit 51e547e8c89c).
Real-world impact
An attacker can cause a kernel crash (kernel panic) by sending forged TCP-AO packets, leading to a denial‑of‑service for the affected machine.
Why this severity
The CVSS score of 9.8 reflects that the flaw is exploitable remotely with no authentication, can be triggered by any network traffic, and allows complete compromise of the system (crash).
What to do about it
- 01Upgrade the Linux kernel to a version that includes the patch (commit 51e547e8c89c).
- 02Reboot the system to load the new kernel.
NVD-referenced vendor advisory
Timeline
- Jul 25, 2026 · 7d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 27, 2026 · 5d agoOfficial fix availableA vendor patch or mitigation now exists — see the remediation steps above.