Linux EUVD-2026-12810

While CVSS and EPSS scores are not provided in the advisory data, the vulnerability carries moderate real-world risk. The attack vector is network-based and requires no authentication or user interaction, but exploiting it requires sophisticated off-path techniques and detailed knowledge of the target environment's TCP behavior, placing it in the 'medium complexity' category. The technical impact is limited to information disclosure (source port leakage) rather than confidentiality or integrity violation of actual data. However, source port prediction is a well-established primitive in TCP connection hijacking attacks, particularly in scenarios where firewall rules or network segmentation is weak. The fact that this was addressed through a formal commit reverting a prior downgrade, combined with multiple stable kernel patch releases (6.18.17, 6.19.7, 7.0-rc3), indicates the Linux kernel maintainers assessed this as requiring priority remediation. Without KEV designation data or active exploitation reports in the provided intelligence, this should be treated as a proactive security improvement rather than an emergency—however, organizations running public-facing TCP services should prioritize patching. The vulnerability requires network access and technical exploitation skills, limiting the attacker pool to sophisticated threat actors.

An off-path attacker (not on the network path between client and server) monitors SYN-ACK packets from a target server to extract timestamp values. By correlating these timestamps with knowledge of the server's siphash key derivation and the victim client's IP address, the attacker can infer the likely source port used by the client in the TCP connection. This leaked source port information can then be used to forge RST packets or craft connection hijacking attempts that guess the ISN more accurately. For example, an attacker might target a user connecting to a remote VPN or SSH server, leak the source port, and use it to inject malicious packets into the established TCP stream with higher success rate than random guessing—even more dangerous in scenarios where the attacker can also influence server responses (e.g., compromised intermediate proxy or BGP hijacking). While no public proof-of-concept is referenced in the available intelligence, the technique builds on well-known TCP side-channel research and the vulnerability was discovered through security research (reported by Zhouyan Deng) rather than in-the-wild exploitation.