CVE-2026-23247: 
Linux Kernel vulnerability analysis and mitigation

CVE-2026-23247 is a Linux kernel vulnerability in the TCP secure_seq subsystem that allows off-path attackers to leak TCP source port information via a SYN cookie side-channel. The flaw was introduced when commit 28ee1b746f49 downgraded TCP timestamp (TS) offset randomization from per-connection (including ports) to per-host only, removing port information from the randomization and enabling the side-channel. It was reported by Zhouyan Deng and disclosed on March 18, 2026. Affected versions span Linux kernel 4.11 through 6.18.16 and 6.19.0 through 6.19.6. It carries a CVSS v3.1 base score of 5.5 (Medium) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is an information exposure through a timing/side-channel (CWE-200/CWE-203) in the Linux kernel's TCP timestamp offset generation. When commit 28ee1b746f49 removed TCP port information from the SYN cookie TS offset computation, the offset became predictable on a per-host basis, allowing an off-path attacker to infer source port values by observing TCP timestamp values in SYN cookies. The fix reverts this change, restoring TCP source and destination ports as inputs to the SipHash computation used to generate both the Initial Sequence Number (ISN) and the TS offset, making the offset unique per connection rather than per host. Exploitation requires local low-privilege access (attack vector: local, privileges required: low) and no user interaction (Red Hat Bugzilla, Feedly).

Successful exploitation allows an off-path attacker with low local privileges to leak TCP source port information from SYN cookies, which can be used to predict TCP connection parameters and potentially facilitate TCP hijacking or injection attacks against active connections. There is no direct confidentiality impact on data payloads, no integrity impact, and no availability impact — the primary risk is information disclosure that enables follow-on network-layer attacks. The vulnerability's availability impact is rated High in the CVSS score due to potential for disruption if connection parameters are manipulated (Red Hat Advisory, Feedly).

The fix is available in Linux kernel versions 6.18.17, 6.19.7, and later, as well as in the 7.0-rc3 release candidate, with patches backported to stable branches (Red Hat Bugzilla, Feedly). Patch commits are available at the upstream kernel stable repository. For systems that cannot be updated immediately, administrators should monitor for suspicious off-path TCP connection attempts and consider implementing network-level filtering to restrict SYN cookie abuse patterns. Amazon Linux 2023 users can apply the fix via ALAS2023-2026-1596.

Red Hat tracked the issue via Bugzilla (Bug 2448598) and assigned it medium severity, consistent with the CVSS score. The upstream kernel announcement was made via the linux-cve-announce mailing list by Greg Kroah-Hartman. No significant broader media coverage or notable researcher commentary beyond the initial disclosure has been identified (Red Hat Bugzilla, Kernel Announce).