CVE-2026-64268
Received Received - Intake

Buffer Overflow in Linux Kernel RDMA/siw Driver

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accumulates wqe->processed, but it never checks the running total against the sink buffer length on continuation segments. siw_check_sge() resolves and validates the sink memory only on the first fragment (the if (!*mem) branch), and siw_rresp_check_ntoh() compares the cumulative length against wqe->bytes only on the final segment (the !frx->more_ddp_segs guard). A connected siw peer that answers an outstanding RREAD with Read Response segments that keep the DDP Last flag clear, carrying more total payload than the RREAD requested, drives wqe->processed past the validated sink buffer; the next siw_rx_data() call writes out of bounds at sge->laddr + wqe->processed. siw runs iWARP over ordinary routable TCP, so the peer is the remote end of an established RDMA connection and needs no local privilege. Bound every segment before placement, exactly as siw_proc_send() and siw_proc_write() already do for their tagged and untagged paths, and terminate the connection with a base-or-bounds DDP error when the Read Response would overrun the sink buffer. This is the second receive-path length fix for this file. A separate change rejects an MPA FPDU length that underflows the per-fragment remainder in the header decode; that guard does not cover this case, because here each individual segment length is self-consistent and only the accumulated placement offset overruns the buffer.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64268
EUVD
EUVD-2026-48980

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of Read Response data in the RDMA subsystem. A remote peer can send Read Response segments that exceed the requested length, causing the kernel to write data outside the allocated buffer. The issue occurs because the code does not validate the cumulative length of all segments against the buffer size during processing.

Detection Guidance

This vulnerability is specific to the Linux kernel's RDMA/siw driver and requires inspection of kernel logs or network traffic involving iWARP connections. Check for kernel messages related to out-of-bounds writes in siw_qp_rx.c or siw_proc_rresp(). Monitor network connections using tools like tcpdump or Wireshark for malformed RDMA Read Response segments.

Impact Analysis

This vulnerability allows a remote attacker connected via an established RDMA connection to cause a buffer overflow. This could lead to system crashes, data corruption, or potentially arbitrary code execution on the affected system. The attacker does not need local privileges to exploit this issue.

Mitigation Strategies

Apply the latest kernel patches that address this issue. Disable the siw driver if not in use by blacklisting it. Restrict network access to RDMA services to trusted peers only. Monitor for unusual network traffic or kernel crashes that may indicate exploitation attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64268. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart