CVE-2026-64414
Received Received - Intake

Linux Kernel Fragment Handling Denial of Service

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragments (such as from devmem TCP, where skb_frags_readable(skb) returns false) is processed by the u32 module, skb_copy_bits() will safely return a negative error code [..] xt_u32: bail out with hotdrop in this case. gather_frags: return -1, just as if we had no fragment header. nfnetlink_queue: restrict to the linear part. nfnetlink_log: restrict to the linear part. v2: - skb_zerocopy helpers don't copy readable flag, i.e. nfnetlink_queue is broken too xt_u32 shouldn't return true if hotdrop was set.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64414
EUVD
EUVD-2026-48958

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux_kernel linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of network packet fragments marked as unreadable. When such fragments are processed by the u32 module, functions like skb_copy_bits() may return errors, leading to potential denial-of-service conditions or incorrect packet handling.

Detection Guidance

This vulnerability involves unreadable fragments in network packets processed by the Linux kernel's netfilter components. Detection requires monitoring for kernel logs or network stack errors related to skb_frags_readable() failures or u32 module processing issues. Check kernel logs with 'dmesg | grep -i frag' or 'journalctl -k | grep -i frag' for errors. Monitor network interfaces for packet drops or errors using 'ip -s link' or 'ethtool -S <interface>'. No specific commands are provided in the context to directly detect this issue.

Impact Analysis

The vulnerability could allow an attacker to cause a system crash or disrupt network operations by sending maliciously crafted packets. Systems relying on the affected kernel components may experience instability or reduced performance.

Mitigation Strategies

Immediate mitigation involves updating the Linux kernel to a patched version that resolves the issue. Check your distribution's security advisories or kernel updates. If updating is not immediately possible, consider disabling the u32 netfilter module temporarily with 'modprobe -r xt_u32' and monitor for any impact on network filtering rules. Ensure your system is running a kernel version that includes the fix for this CVE.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64414. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart