CVE-2026-64009
Received Received - Intake

Linux Kernel XFRM State MTU Underflow Vulnerability

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrm_state_mtu Leo Lin reported OOB write issue in esp component: xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "header_len + authsize + net_adj" subtracted from a small "mtu" argument. A nobody user can install an IPv4 ESP tunnel SA with a large authentication key (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc), configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a large value. When a single UDP datagram is then sent through the tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and esp_output() consumes it as a signed int via: padto = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached)) esp.tfclen = padto - skb->len (assigned to int) esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t when passed to memset() inside esp_output_fill_trailer(), producing a ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as "Write of size 18446744073709551537 at addr ffff888...". Check for underflow and return 1. This causes the sendmsg attempt to fail with ENETUNREACH.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64009
EUVD
EUVD-2026-45582

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Linux kernel vulnerability where an attacker can cause an out-of-bounds write in the esp component. The issue occurs in xfrm_state_mtu() which performs arithmetic in unsigned modulo-2^32 space. An attacker can install a specially crafted IPv4 ESP tunnel SA with a large authentication key and small interface MTU, leading to an underflow that results in a near-2^32 value. This causes a large negative value to be written to memory via memset(), potentially corrupting data.

Detection Guidance

This vulnerability involves an out-of-bounds write in the Linux kernel's xfrm_state_mtu function. Detection requires checking for kernel logs indicating large memory writes or KASAN reports of writes at high addresses. Monitor for crashes or unusual network behavior after applying patches or updates.

Impact Analysis

An attacker with local access could exploit this to cause a denial of service or potentially execute arbitrary code with kernel privileges. The vulnerability allows writing a large amount of data to kernel memory, which could crash the system or lead to privilege escalation. Systems using IPv4 ESP tunnels with authentication are most at risk.

Compliance Impact

This vulnerability could potentially impact compliance with GDPR or HIPAA by enabling unauthorized memory writes that may lead to data corruption or exposure. The OOB write in the esp component could allow an attacker to manipulate kernel memory, potentially violating data integrity or confidentiality requirements under these regulations.

Mitigation Strategies

Apply the Linux kernel patch that resolves the xfrm_state_mtu underflow issue. Monitor for unusual network activity or memory corruption signs like large memset operations. Restrict unprivileged users from configuring ESP tunnels or modifying interface MTUs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64009. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart