CVE-2026-64009

Analyzed Analyzed - Analysis Complete

Linux Kernel XFRM State MTU Underflow Vulnerability

Publication date: 2026-07-19

Last updated on: 2026-10-16

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrm_state_mtu Leo Lin reported OOB write issue in esp component: xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "header_len + authsize + net_adj" subtracted from a small "mtu" argument. A nobody user can install an IPv4 ESP tunnel SA with a large authentication key (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc), configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a large value. When a single UDP datagram is then sent through the tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and esp_output() consumes it as a signed int via: padto = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached)) esp.tfclen = padto - skb->len (assigned to int) esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t when passed to memset() inside esp_output_fill_trailer(), producing a ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as "Write of size 18446744073709551537 at addr ffff888...". Check for underflow and return 1. This causes the sendmsg attempt to fail with ENETUNREACH.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-07-19

EPSS Evaluated

2026-10-18

NVD

CVE-2026-64009

EUVD

EUVD-2026-45582

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 5.16 (inc) to 6.1.176 (exc)
linux	linux_kernel	From 6.13 (inc) to 6.18.35 (exc)
linux	linux_kernel	From 6.2 (inc) to 6.6.143 (exc)
linux	linux_kernel	From 6.7 (inc) to 6.12.93 (exc)
linux	linux_kernel	From 5.11 (inc) to 5.15.210 (exc)
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.12 (exc)
linux	linux_kernel	From 2.6.22 (inc) to 5.10.259 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-787	The product writes data past the end, or before the beginning, of the intended buffer.

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where an attacker can cause an out-of-bounds write in the esp component. The issue occurs in xfrm_state_mtu() which performs arithmetic in unsigned modulo-2^32 space. An attacker can install a specially crafted IPv4 ESP tunnel SA with a large authentication key and small interface MTU, leading to an underflow that results in a near-2^32 value. This causes a large negative value to be written to memory via memset(), potentially corrupting data.

Detection Guidance

This vulnerability involves an out-of-bounds write in the Linux kernel's xfrm_state_mtu function. Detection requires checking for kernel logs indicating large memory writes or KASAN reports of writes at high addresses. Monitor for crashes or unusual network behavior after applying patches or updates.

Impact Analysis

An attacker with local access could exploit this to cause a denial of service or potentially execute arbitrary code with kernel privileges. The vulnerability allows writing a large amount of data to kernel memory, which could crash the system or lead to privilege escalation. Systems using IPv4 ESP tunnels with authentication are most at risk.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA by enabling unauthorized memory writes that may lead to data corruption or exposure. The OOB write in the esp component could allow an attacker to manipulate kernel memory, potentially violating data integrity or confidentiality requirements under these regulations.

Mitigation Strategies

Apply the Linux kernel patch that resolves the xfrm_state_mtu underflow issue. Monitor for unusual network activity or memory corruption signs like large memset operations. Restrict unprivileged users from configuring ESP tunnels or modifying interface MTUs.

Hi! I’m here to help you understand CVE-2026-64009. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70