CyberSecBulletin
CVE-2026-64102NVD status: Modified

Linux: Out-of-bounds Read

Published Updated By the CyberSecBulletin desk

CVE-2026-64102 is a critical-severity out-of-bounds read vulnerability in Linux, with a CVSS 3.1 base score of 9.8 out of 10. It can be exploited remotely over the network by an unauthenticated attacker, without any action from a user. The record lists versions 683f7cfbf514193d63c0efa079f3352bde84c2e0, 4a331582011d9e8089af8aa2a61ec6b4443bb245, 33a8b5e971e294ec2a7b74211c545e09efd8e9ac as the first without the flaw, so updating Linux to one of those releases or later removes the exposure. There is no confirmed exploitation so far. EPSS estimates a 0.5% chance of exploitation within 30 days, which is low compared with other CVEs.

Patch this week

Critical severity: a successful attack would have severe impact.

What to do

  1. Update Linux to 683f7cfbf514193d63c0efa079f3352bde84c2e0 or 4a331582011d9e8089af8aa2a61ec6b4443bb245 or 33a8b5e971e294ec2a7b74211c545e09efd8e9ac or 14553be882d9ce91749c9d64041de66e34ad8e70, whichever matches your release line, or a later version.
  2. Update Linux Kernel to 5.10.258 or 5.15.209 or 6.1.175 or 6.6.142, whichever matches your release line, or a later version.
  3. Until you can update, restrict network access to the affected service so it is not reachable from untrusted networks.

Affected products and versions

VendorProductAffected versionsFixed in
LinuxLinux8b6a361b8c482f22ac99c3273285ff16b23fba91 up to, but not including, 683f7cfbf514193d63c0efa079f3352bde84c2e0; 8b6a361b8c482f22ac99c3273285ff16b23fba91 up to, but not including, 4a331582011d9e8089af8aa2a61ec6b4443bb245; 8b6a361b8c482f22ac99c3273285ff16b23fba91 up to, but not including, 33a8b5e971e294ec2a7b74211c545e09efd8e9ac; 8b6a361b8c482f22ac99c3273285ff16b23fba91 up to, but not including, 14553be882d9ce91749c9d64041de66e34ad8e70; 8b6a361b8c482f22ac99c3273285ff16b23fba91 up to, but not including, c7c0c0f4379dedec12d24dbb9dded5d2db7fd9f2; 8b6a361b8c482f22ac99c3273285ff16b23fba91 up to, but not including, 1012896f4225e8f801ff3c1648023845b66dfb11; 8b6a361b8c482f22ac99c3273285ff16b23fba91 up to, but not including, 775b4dc9618a99a1fa48b57554041a5dc17e1336; 8b6a361b8c482f22ac99c3273285ff16b23fba91 up to, but not including, 0ce1bc9e46ecabe84772bb561e373c0d9876d6f2; and 1 more ranges683f7cfbf514193d63c0efa079f3352bde84c2e0, 4a331582011d9e8089af8aa2a61ec6b4443bb245, 33a8b5e971e294ec2a7b74211c545e09efd8e9ac, 14553be882d9ce91749c9d64041de66e34ad8e70, c7c0c0f4379dedec12d24dbb9dded5d2db7fd9f2, 1012896f4225e8f801ff3c1648023845b66dfb11
LinuxLinux Kernel5.3 up to, but not including, 5.10.258; 5.11 up to, but not including, 5.15.209; 5.16 up to, but not including, 6.1.175; 6.2 up to, but not including, 6.6.142; 6.7 up to, but not including, 6.12.92; 6.13 up to, but not including, 6.18.34; 6.19 up to, but not including, 7.0.11; 7.15.10.258, 5.15.209, 6.1.175, 6.6.142, 6.12.92, 6.18.34

Version data comes from the organisation that assigned the CVE. Confirm against the vendor advisory before deciding you are unaffected.

How the severity score breaks down

Attack vector
NetworkCan be exploited remotely over a network, including the internet.
Attack complexity
LowNo special conditions are needed; the attack works reliably.
Privileges required
NoneNo account or login is needed.
User interaction
NoneNo action by a victim is required.
Scope
UnchangedImpact stays within the vulnerable component.
Confidentiality
HighAll data handled by the component can be read.
Integrity
HighData or code can be modified at will.
Availability
HighThe component can be taken down completely.

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. Scored by CNA.

Official description

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data() then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->skb_new); is handed to siw_check_mem() as an int len (whose interval check addr + len > mem->va + mem->len is satisfied for a valid base when len is negative), and reaches siw_rx_data() -> siw_rx_kva() / siw_rx_umem() -> skb_copy_bits() as a signed copy length. The header copy branch in skb_copy_bits() promotes that to size_t, producing a multi-gigabyte read. KASAN under a KUnit harness that drives the real kernel TCP receive path -- a loopback AF_INET socketpair, the malformed FPDU written via kernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock dispatching to siw_tcp_rx_data -- reports: BUG: KASAN: use-after-free in skb_copy_bits+0x284/0x480 Read of size 4294967295 at addr ffff888... Call Trace: skb_copy_bits siw_rx_kva siw_rx_data siw_check_mem siw_proc_write siw_tcp_rx_data __tcp_read_sock siw_qp_llp_data_ready tcp_data_ready tcp_data_queue Add the missing invariant at the earliest point where the peer header is fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly the value the siw transmitter uses as the minimum mpa_len for each opcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the protocol contract. Out-of-range FPDUs terminate the connection with TERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which is RFC 5044 Section 8 error code 3 ("Marker and ULPDU Length fields do not agree on the start of an FPDU"), the correct framing-error class for this inconsistency.

Source: the CVE record as published by its numbering authority, via NVD and CVE.org.

The underlying weakness: Out-of-bounds Read

The product reads data past the end, or before the beginning, of the intended buffer.

How developers prevent this class of flaw

  • Use a language that provides appropriate memory abstractions.

More Out-of-bounds Read vulnerabilities (CWE-125)

Timeline

  1. CVE record published.
  2. CISA published its SSVC assessment (exploitation: none, automatable: yes, technical impact: total).
  3. Record last changed materially (score, affected products, status or references).

References

Recent Out-of-bounds Read vulnerabilities

Spotted an error? Tell us.