CyberSecBulletin
CVE-2026-64047NVD status: Modified

Linux: Off-by-one Error

Published Updated By the CyberSecBulletin desk

CVE-2026-64047 is a critical-severity off-by-one error vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 73963a375885d5ccb7def39fd0b4f542e0f343dd, 47110c3a9ac247b688657337f5981efcfcb240dc, 84158c2997159df4a0d70cd9c46774512d32a522 as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.51% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 73963a375885d5ccb7def39fd0b4f542e0f343dd or 47110c3a9ac247b688657337f5981efcfcb240dc or 84158c2997159df4a0d70cd9c46774512d32a522 or 131ef12057d92b77b636321b7849c69222405a97, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.5 or 5.10.258 or 5.15.209 or 6.1.175, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux9aaaa56845a06aeabdd597cbe19492dc01f281ec up to, but not including, 73963a375885d5ccb7def39fd0b4f542e0f343dd; 9aaaa56845a06aeabdd597cbe19492dc01f281ec up to, but not including, 47110c3a9ac247b688657337f5981efcfcb240dc; 9aaaa56845a06aeabdd597cbe19492dc01f281ec up to, but not including, 84158c2997159df4a0d70cd9c46774512d32a522; 9aaaa56845a06aeabdd597cbe19492dc01f281ec up to, but not including, 131ef12057d92b77b636321b7849c69222405a97; 9aaaa56845a06aeabdd597cbe19492dc01f281ec up to, but not including, 66339b71f105e6f83e0da3b9583d95077534fe1d; 9aaaa56845a06aeabdd597cbe19492dc01f281ec up to, but not including, eca989eab4b2599dcb02f72140a7c08f08838520; 9aaaa56845a06aeabdd597cbe19492dc01f281ec up to, but not including, 2fb0dc7e0099686c4e9d2732745d8a31b18c3628; 9aaaa56845a06aeabdd597cbe19492dc01f281ec up to, but not including, 285943c6e7ca309bbea84b253745154241d9788a; and 3 more ranges73963a375885d5ccb7def39fd0b4f542e0f343dd, 47110c3a9ac247b688657337f5981efcfcb240dc, 84158c2997159df4a0d70cd9c46774512d32a522, 131ef12057d92b77b636321b7849c69222405a97, 66339b71f105e6f83e0da3b9583d95077534fe1d, eca989eab4b2599dcb02f72140a7c08f08838520
LinuxLinux Kernel5.4.14 up to, but not including, 5.5; 5.5.1 up to, but not including, 5.10.258; 5.11 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.142; 6.7 up to, but not including, 6.12.92; 6.13 up to, but not including, 6.18.34; 6.19 up to, but not including, 7.0.11; and 2 more ranges5.5, 5.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring When an sk_msg scatterlist ring wraps (sg.end < sg.start), tls_push_record() chains the tail portion of the ring to the head using sg_chain(). An extra entry in the sg array is reserved for this: struct sk_msg_sg { [...] /* The extra two elements: * 1) used for chaining the front and sections when the list becomes * partitioned (e.g. end < start). The crypto APIs require the * chaining; * 2) to chain tailer SG entries after the message. */ struct scatterlist data[MAX_MSG_FRAGS + 2]; The current code uses MAX_SKB_FRAGS + 1 as the ring size: sg_chain(&msg_pl->sg.data[msg_pl->sg.start], MAX_SKB_FRAGS - msg_pl->sg.start + 1, msg_pl->sg.data); This places the chain pointer at sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. = &data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 = data[start + (MAX_SKB_FRAGS - start + 1) - 1] = data[MAX_SKB_FRAGS] instead of the true last entry. This is likely due to a "race" of the commit under Fixes landing close to commit 031097d9e079 ("bpf: sk_msg, zap ingress queue on psock down") Convert to ARRAY_SIZE and drop the data[start] / - start (as suggested by Sabrina).

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Off-by-one Error

A product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.

How developers prevent this class of flaw

  • When copying character arrays or using character manipulation methods, the correct size parameter must be used to account for the null terminator that needs to be added at the end of the array. Some examples of functions susceptible to this weakness in C include strcpy(), strncpy(), strcat(), strncat(), printf(), sprintf(), scanf() and sscanf().

More Off-by-one Error vulnerabilities (CWE-193)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Off-by-one Error vulnerabilities

Spotted an error? Tell us.