What is the CVSS score of EUVD-2026-48966?

EUVD-2026-48966 has a CVSS 3.1 base score of 7.1 (High). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.2%.

Which versions of Linux Kernel are affected by EUVD-2026-48966?

Linux kernel TCP/IPv4 networking contains an integer overflow vulnerability (CVE-2026-64422, CVSS 7.1) allowing local users with network-namespace privileges to read kernel memory or crash systems.. A patch is available.

How to fix or mitigate EUVD-2026-48966?

Within 24 hours, identify systems with tcp_mtu_probing=2 enabled and those running container orchestration platforms or multi-tenant virtualization with network namespaces assigned to tenant applications. Within 7 days, apply the released vendor kernel patch to all staging environments and validate system stability. Within 30 days, deploy the patched kernel to all production systems, prioritizing container platforms and multi-tenant cloud infrastructure.

Linux Kernel EUVD-2026-48966

| CVE-2026-64422 HIGH

Integer Overflow or Wraparound (CWE-190)

2026-07-25 Linux

GHSA-gwmg-q555-3325

Buffer Overflow Linux Integer Overflow

7.1

CVSS 3.1 · Vendor: Linux

Severity by source

Vendor (Linux) PRIMARY

7.1 HIGH

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H

vuln.today AI

6.3 MEDIUM

Requires both tcp_mtu_probing=2 (non-default) and a negative sysctl write via namespaced CAP_NET_ADMIN, making AC:H; PR:L for network namespace access; no integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H

4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Red Hat

7.0 MEDIUM

qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 27, 2026 - 05:51 vuln.today

CVSS changed

Jul 27, 2026 - 05:22 NVD

7.1 (HIGH)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:51 cve.org

HIGH 7.1

CVE Published

Jul 25, 2026 - 08:51 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: ipv4: bound TCP reordering sysctl writes and MTU probe sizes

Reject invalid net.ipv4.tcp_reordering values before they reach TCP socket state. The sysctl is stored as an int but copied into the u32 tp->reordering field for new sockets, so negative writes wrap to large values.

With tcp_mtu_probing=2, the wrapped value can overflow the tcp_mtu_probe() size calculation and drive the MTU probing path into an out-of-bounds read. Route tcp_reordering writes through proc_dointvec_minmax() and require it to be at least 1. Also require tcp_max_reordering to be at least 1 so the configured maximum cannot become negative either.

When registering the table for a non-init network namespace, relocate extra2 pointers that refer into init_net.ipv4 so the tcp_reordering upper bound follows that namespace's tcp_max_reordering.

Harden tcp_mtu_probe() itself by computing size_needed as u64. This keeps the send queue and window checks from being bypassed through signed integer overflow.

AnalysisAI

Integer overflow in the Linux kernel's TCP networking subsystem (net/ipv4) allows a local user with network-namespace privileges to trigger an out-of-bounds read, potentially disclosing kernel memory or crashing the system. Writing a negative integer to the net.ipv4.tcp_reordering sysctl causes a silent type-coercion wrap when the value is copied into the u32 tp->reordering field, producing an enormous effective value. When tcp_mtu_probing=2 is also active, this wrapped value overflows the size_needed computation in tcp_mtu_probe(), bypassing send-queue and window bounds checks entirely, leading to a CWE-190 integer overflow driving a subsequent out-of-bounds read. No public exploit and no KEV listing have been identified at time of analysis; EPSS is 0.23%.

Technical ContextAI

The vulnerability resides in the Linux kernel's IPv4 TCP stack, specifically in the sysctl handler for net.ipv4.tcp_reordering and the tcp_mtu_probe() function in net/ipv4/tcp_output.c. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* across a broad version range originating at commit 91cc17c0e5e5 (Linux 2.6.24 era). The root cause (CWE-190) is a signed-to-unsigned type confusion: the sysctl stores the value as a signed int, but tcp_sock->reordering is a u32. A negative write (e.g., -1) wraps to 0xFFFFFFFF (~4 billion) when assigned to the u32 field. The MTU probing path (tcp_mtu_probing=2) then uses this giant reordering value in an arithmetic expression for size_needed, which itself overflows before the send-queue and congestion-window bounds are checked, triggering an out-of-bounds read of kernel heap memory. The fix routes sysctl writes through proc_dointvec_minmax() clamping to ≥1, hardens tcp_max_reordering similarly, fixes extra2 pointer relocation for non-init network namespaces, and promotes size_needed to u64 in tcp_mtu_probe() to prevent signed overflow.

RemediationAI

Upgrade to a patched stable kernel release: 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.96, 6.18.39, 7.1.4, or 7.2-rc1. Ubuntu users should apply updates per USN-8726-1 (https://ubuntu.com/security/notices/USN-8726-1) and USN-8727-1 (https://ubuntu.com/security/notices/USN-8727-1). Patch commits are available at the kernel stable git repository (e.g., https://git.kernel.org/stable/c/f0d88a4cd03affff6c08adf6c63964e235aede43 for one backport). As a compensating control on unpatched systems, ensure net.ipv4.tcp_mtu_probing is set to 0 or 1 (default is 0), which removes the code path required to turn the wrapped reordering value into an OOB read - note this disables MTU probing for lossy networks, which may slightly impact TCP performance on paths with path-MTU black holes. Restricting unprivileged user namespaces (kernel.unprivileged_userns_clone=0 or equivalent) limits the ability of local users to write to network sysctls without root.

Same weakness CWE-190 – Integer Overflow or Wraparound

View all

CVE-2013-2729 CRITICAL POC

9.8

CVE-2015-8651 HIGH

8.8

CVE-2012-5054 HIGH POC

8.8

CVE-2014-0569 CRITICAL POC

9.3

CVE-2023-21716 CRITICAL POC

9.8

CVE-2017-3599 HIGH POC

7.5

CVE-2017-7529 HIGH

7.5

CVE-2016-1010 HIGH

8.8

Same technique Buffer Overflow

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2020-0796 CRITICAL POC

10.0

CVE-2019-11043 CRITICAL POC

9.8

CVE-2009-0927 HIGH POC

8.8

CVE-2012-1889 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise Desktop 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Affected
SUSE Linux Enterprise High Availability Extension 16.0	Affected

EUVD-2026-48966 vulnerability details – vuln.today

Back

Linux Kernel EUVD-2026-48966

Severity by source

CVSS VectorVendor: Linux

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

Same weakness CWE-190 – Integer Overflow or Wraparound

Same technique Buffer Overflow

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code