---
id: CVE-2026-23247
title: 'tcp: secure_seq: add back ports to TS offset'
summary: >-
  In the Linux kernel, the following vulnerability has been resolved:


  tcp: secure_seq: add back ports to TS offset


  This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp
  offsets")


  tcp_tw_recycle went away in 2017.


  Zhou…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 <
    e873e8c16b2fb743a381a9e59c108e63512301ec
  - >-
    Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 <
    5da5662181ef8a251e3ba564903002c2e87de452
  - >-
    Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 <
    eae2f14ab2efccdb7480fae7d42c4b0116ef8805
  - >-
    Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 <
    46e5b0d7cf55821527adea471ffe52a5afbd9caf
  - >-
    Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 <
    165573e41f2f66ef98940cf65f838b2cb575d9d1
  - Linux 443fac9f2618b93cbc5ab068dc594530236b3a23
  - Linux >= 4.10.14 < 4.11
  - Linux 4.11
published: '2026-03-18'
updated: '2026-10-21'
sourceUpdated: '2026-10-21T12:39:02.742Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-23247'
references:
  - url: 'https://git.kernel.org/stable/c/e873e8c16b2fb743a381a9e59c108e63512301ec'
  - url: 'https://git.kernel.org/stable/c/5da5662181ef8a251e3ba564903002c2e87de452'
  - url: 'https://git.kernel.org/stable/c/eae2f14ab2efccdb7480fae7d42c4b0116ef8805'
  - url: 'https://git.kernel.org/stable/c/46e5b0d7cf55821527adea471ffe52a5afbd9caf'
  - url: 'https://git.kernel.org/stable/c/165573e41f2f66ef98940cf65f838b2cb575d9d1'
tags:
  - cve.org
epss: 0.00123
epssPercentile: 0.01865
ingestedAt: '2026-10-21T12:48:53.669Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

tcp: secure_seq: add back ports to TS offset

This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets")

tcp_tw_recycle went away in 2017.

Zhouyan Deng reported off-path TCP source port leakage via
SYN cookie side-channel that can be fixed in multiple ways.

One of them is to bring back TCP ports in TS offset randomization.

As a bonus, we perform a single siphash() computation
to provide both an ISN and a TS offset.

## Affected

- `Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < e873e8c16b2fb743a381a9e59c108e63512301ec`
- `Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 5da5662181ef8a251e3ba564903002c2e87de452`
- `Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < eae2f14ab2efccdb7480fae7d42c4b0116ef8805`
- `Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 46e5b0d7cf55821527adea471ffe52a5afbd9caf`
- `Linux >= 28ee1b746f493b7c62347d714f58fbf4f70df4f0 < 165573e41f2f66ef98940cf65f838b2cb575d9d1`
- `Linux 443fac9f2618b93cbc5ab068dc594530236b3a23`
- `Linux >= 4.10.14 < 4.11`
- `Linux 4.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.