CVE-2019-10638

What it actually does

The flaw leaks the kernel's IP ID hashing key for connectionless protocols via hash collisions induced by traffic to multiple attacker-controlled destinations, enabling device tracking through predictable IP ID sequences.

Why it matters to the business

Unpatched Linux systems remain exposed to long-term device fingerprinting and tracking, increasing privacy and targeted attack risks across servers, desktops, and embedded devices that rely on the affected kernel versions.

How an attack unfolds

An attacker hosts a crafted webpage that leverages WebRTC or gQUIC to trigger UDP traffic from the victim to multiple attacker IPs; by observing resulting IP ID values the attacker enumerates collisions to recover the hashing key and thereafter track the device across networks.

How to fix it

Upgrade the Linux kernel to a version containing commit 355b98553789b646ed97ad801a619ff898471b92 or later; rebuild and reboot all affected systems with the patched kernel.

How to confirm the fix worked

Verify the running kernel contains commit 355b98553789b646ed97ad801a619ff898471b92, confirm IP ID values no longer exhibit the original predictable collision behavior under test traffic, and review kernel changelog or source for the fix.

Typical attack path

1. Host malicious webpage using WebRTC or gQUIC
2. Force victim to send UDP/ICMP packets to multiple attacker-controlled destinations
3. Collect IP ID values and search for hash collisions
4. Enumerate to recover the kernel's IP ID hashing key
5. Use recovered key to correlate and track the device over time

How to detect it

Review network flow logs and packet captures for repeated UDP or ICMP traffic to suspicious external IPs coinciding with WebRTC or QUIC sessions; inspect kernel source or build logs for absence of the referenced commit.

What your security team should do

• Prioritize kernel upgrades on all internet-facing and user-facing Linux systems
• Monitor network traffic for anomalous UDP/ICMP patterns that could indicate tracking attempts
• Apply the fix in staged rollouts beginning with high-exposure hosts
• Rebuild custom kernels or distributions to incorporate the referenced commit