{"id":"CVE-2026-23247","title":"tcp: secure_seq: add back ports to TS offset","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\ntcp: secure_seq: add back ports to TS offset\n\nThis reverts 28ee1b746f49 (\"secure_seq: downgrade to per-host timestamp offsets\")\n\ntcp_tw_recycle went away in 2017.\n\nZhou…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < e873e8c16b2fb743a381a9e59c108e63512301ec","Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 5da5662181ef8a251e3ba564903002c2e87de452","Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < eae2f14ab2efccdb7480fae7d42c4b0116ef8805","Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 46e5b0d7cf55821527adea471ffe52a5afbd9caf","Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 165573e41f2f66ef98940cf65f838b2cb575d9d1","Linux 443fac9f2618b93cbc5ab068dc594530236b3a23","Linux >= 4.10.14 < 4.11","Linux 4.11"],"published":"2026-03-18","updated":"2026-10-21","sourceUpdated":"2026-10-21T12:39:02.742Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-23247","references":[{"url":"https://git.kernel.org/stable/c/e873e8c16b2fb743a381a9e59c108e63512301ec"},{"url":"https://git.kernel.org/stable/c/5da5662181ef8a251e3ba564903002c2e87de452"},{"url":"https://git.kernel.org/stable/c/eae2f14ab2efccdb7480fae7d42c4b0116ef8805"},{"url":"https://git.kernel.org/stable/c/46e5b0d7cf55821527adea471ffe52a5afbd9caf"},{"url":"https://git.kernel.org/stable/c/165573e41f2f66ef98940cf65f838b2cb575d9d1"}],"tags":["cve.org"],"epss":0.00123,"epssPercentile":0.01865,"ingestedAt":"2026-10-21T12:48:53.669Z","slug":"CVE-2026-23247","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\ntcp: secure_seq: add back ports to TS offset\n\nThis reverts 28ee1b746f49 (\"secure_seq: downgrade to per-host timestamp offsets\")\n\ntcp_tw_recycle went away in 2017.\n\nZhouyan Deng reported off-path TCP source port leakage via\nSYN cookie side-channel that can be fixed in multiple ways.\n\nOne of them is to bring back TCP ports in TS offset randomization.\n\nAs a bonus, we perform a single siphash() computation\nto provide both an ISN and a TS offset.\n\n## Affected\n\n- `Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < e873e8c16b2fb743a381a9e59c108e63512301ec`\n- `Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 5da5662181ef8a251e3ba564903002c2e87de452`\n- `Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < eae2f14ab2efccdb7480fae7d42c4b0116ef8805`\n- `Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 46e5b0d7cf55821527adea471ffe52a5afbd9caf`\n- `Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 165573e41f2f66ef98940cf65f838b2cb575d9d1`\n- `Linux 443fac9f2618b93cbc5ab068dc594530236b3a23`\n- `Linux >= 4.10.14 < 4.11`\n- `Linux 4.11`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}