CVE-2026-98323

Received Received - Intake

BaseFortify

Publication date: 2026-10-06

Last updated on: 2026-10-19

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-06

Last Modified

2026-10-19

Generated

2026-10-19

AI Q&A

2026-10-06

EPSS Evaluated

2026-10-18

NVD

CVE-2026-98323

EUVD

EUVD-2026-93308

Affected Vendors & Products

Vendor	Product	Version / Range
Linux	Linux	e3917c85f41ef1df64e27dc0e46ab0d803c5e73e
Linux	Linux	308cd50f174c95a507527037f4de1a0396aa4325
Linux	Linux	754209850df8367c954ac1de7671c7430b1f342c
Linux	Linux	754209850df8367c954ac1de7671c7430b1f342c
Linux	Linux	754209850df8367c954ac1de7671c7430b1f342c
Linux	Linux	754209850df8367c954ac1de7671c7430b1f342c
Linux	Linux	754209850df8367c954ac1de7671c7430b1f342c
Linux	Linux	754209850df8367c954ac1de7671c7430b1f342c
Linux	Linux	e09caa38e10bcf027100cc22b0e3cc745a39ef0a
Linux	Linux	0c14f795a9eab9344230f9933798b8ee496f497d
Linux	Linux	7fada7c6962219b6fc4ff4e62e46a936af110dd9
Linux	Linux	5.10.150
Linux	Linux	5.15.75
Linux	Linux	5.4.220
Linux	Linux	5.19.17
Linux	Linux	6.0.3
Linux	Linux	6.1

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a flaw in the RDMA/siw module where fragmented header copies are not properly bounded. The siw_get_hdr() function can receive parts of an extended DDP/RDMAP header across multiple TCP callbacks. The issue arises when the first callback copies most of the header but the next one incorrectly limits the copy length, causing the destination to overwrite memory beyond the header. This leads to corruption of the receive state, including fpdu_part_rcvd, which can later be used as a negative copy offset resulting in an out-of-bounds write.

Detection Guidance

This vulnerability affects the Linux kernel's RDMA/siw module and involves improper handling of fragmented header copies in TCP callbacks. Detection requires checking for kernel versions with the vulnerable code and monitoring for related crashes or memory corruption in RDMA operations. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

This vulnerability could allow an attacker to execute arbitrary code or cause a denial of service by triggering an out-of-bounds write in the Linux kernel. If exploited, it may lead to system crashes, data corruption, or unauthorized access to sensitive information. Systems using the affected RDMA/siw module are at risk.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or other standards as it is a low-level kernel memory corruption issue in the RDMA/siw driver. Compliance impacts would depend on system-specific configurations and whether the vulnerability is exploited to access or modify sensitive data.

Mitigation Strategies

Apply the Linux kernel patch that resolves this issue. Update to a version of the Linux kernel that includes the fix for siw_get_hdr() header copy handling. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-98323. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70