CVE-2026-64102
Received Received - Intake

Buffer Overflow in Linux Kernel RDMA/siw Driver

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data() then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->skb_new); is handed to siw_check_mem() as an int len (whose interval check addr + len > mem->va + mem->len is satisfied for a valid base when len is negative), and reaches siw_rx_data() -> siw_rx_kva() / siw_rx_umem() -> skb_copy_bits() as a signed copy length. The header copy branch in skb_copy_bits() promotes that to size_t, producing a multi-gigabyte read. KASAN under a KUnit harness that drives the real kernel TCP receive path -- a loopback AF_INET socketpair, the malformed FPDU written via kernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock dispatching to siw_tcp_rx_data -- reports: BUG: KASAN: use-after-free in skb_copy_bits+0x284/0x480 Read of size 4294967295 at addr ffff888... Call Trace: skb_copy_bits siw_rx_kva siw_rx_data siw_check_mem siw_proc_write siw_tcp_rx_data __tcp_read_sock siw_qp_llp_data_ready tcp_data_ready tcp_data_queue Add the missing invariant at the earliest point where the peer header is fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly the value the siw transmitter uses as the minimum mpa_len for each opcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the protocol contract. Out-of-range FPDUs terminate the connection with TERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which is RFC 5044 Section 8 error code 3 ("Marker and ULPDU Length fields do not agree on the start of an FPDU"), the correct framing-error class for this inconsistency.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64102
EUVD
EUVD-2026-45787

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a flaw in the Soft-iWARP (siw) RDMA driver. A malicious peer can send a malformed iWARP FPDU with an MPA length field smaller than the required DDP/RDMAP header length. This causes an integer underflow, leading to a negative value being used in memory operations. The negative value is then incorrectly interpreted as a large positive number, causing a buffer overflow and potential use-after-free vulnerability.

Detection Guidance

This vulnerability involves a signed integer underflow in the Linux kernel's RDMA/siw driver when processing malformed iWARP FPDU packets. Detection requires monitoring for abnormal network traffic patterns or kernel crashes related to siw or RDMA operations. Check kernel logs for KASAN reports or use-after-free errors in siw-related functions. Network monitoring tools like tcpdump or Wireshark could capture malformed packets if configured to inspect iWARP traffic.

Impact Analysis

This vulnerability can allow an attacker to execute arbitrary code, cause a denial of service, or escalate privileges on a system running a vulnerable Linux kernel with the Soft-iWARP RDMA driver. It may lead to system crashes, data corruption, or unauthorized access if exploited.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory corruption issue in the Linux RDMA subsystem. Compliance impacts would only occur if this flaw were exploited to access or leak sensitive data, which is not described in the provided context.

Mitigation Strategies

Apply the latest Linux kernel patches that address this vulnerability. Disable the siw RDMA driver if not in use. Monitor network traffic for malformed iWARP packets. Update network-facing services to reject invalid MPA FPDU lengths. Ensure kernel address sanitizer (KASAN) is enabled for early detection of memory corruption issues.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64102. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart