Medium 5.5Published Mar 18, 2026

CVE-2026-23247tcp: secure_seq: add back ports to TS offset

Updated under an hour ago (Oct 27, 2026, 7:10 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: tcp: secure_seq: add back ports to TS offset This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets") tcp_tw_recycle went away in 2017. Zhouyan Deng reported off-path TCP source port leakage via SYN cookie side-channel that can be fixed in multiple ways. One of them is to bring back TCP ports in TS offset randomization. As a bonus, we perform a single siphash() computation to provide both an ISN and a TS offset.

CVSS: 5.5 MEDIUM (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Modified
Record last updated: Oct 21, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 28ee1b746f493b7c62347d714f58fbf4f70df4f0 before e873e8c16b2fb743a381a9e59c108e63512301ec; 28ee1b746f493b7c62347d714f58fbf4f70df4f0 builds before 5da5662181ef8a251e3ba564903002c2e87de452; from 28ee1b746f493b7c62347d714f58fbf4f70df4f0 before eae2f14ab2efccdb7480fae7d42c4b0116ef8805; from 28ee1b746f493b7c62347d714f58fbf4f70df4f0 before 46e5b0d7cf55821527adea471ffe52a5afbd9caf; from 28ee1b746f493b7c62347d714f58fbf4f70df4f0 before 165573e41f2f66ef98940cf65f838b2cb575d9d1; 443fac9f2618b93cbc5ab068dc594530236b3a23; from 4.10.14 before 4.11	CNA record
linux linux_kernel linux:linux_kernel	after 4.11 before 6.18.17; from 6.19 before 6.19.7; 4.10.14; 4.11; 4.11; 4.11; 4.11; 7.0; and 1 more ranges	NVD

References

References

https://git.kernel.org/stable/c/e873e8c16b2fb743a381a9e59c108e63512301ec
https://git.kernel.org/stable/c/5da5662181ef8a251e3ba564903002c2e87de452
https://git.kernel.org/stable/c/eae2f14ab2efccdb7480fae7d42c4b0116ef8805	patch
https://git.kernel.org/stable/c/46e5b0d7cf55821527adea471ffe52a5afbd9caf	patch
https://git.kernel.org/stable/c/165573e41f2f66ef98940cf65f838b2cb575d9d1	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.