Out-of-bounds read in Linux kernel - CVE-2026-64114

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU138530

Out-of-bounds read in Linux kernel - CVE-2026-64114

Published: July 20, 2026


Vulnerability identifier: #VU138530
CSH Severity: Low
CVSS v4: 5.6 [CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-64114
CWE-ID: CWE-125
Exploitation vector: Local access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to cause a denial of service.

The vulnerability exists due to an out-of-bounds access in the raw_send_hdrinc IPv4 packet handling in the Linux kernel when processing a malformed IP_HDRINCL packet with an IPv4 header length value less than 5. A local user can send a specially crafted packet through a raw socket to cause a denial of service.

Exploitation requires CAP_NET_RAW. Triggering the reproduced crash path also requires a matching xfrm AH policy on the outgoing route, and loopback does not reach the affected path.


Affected software

Linux kernel
SUSE Linux Enterprise Server 11 SP4 LTSS EXTREME
SUSE Linux Enterprise Server 11
Ubuntu
openEuler
kernel-syms
kernel-xen-base
kernel-ec2-base
kernel-default-debuginfo
kernel-trace-devel
kernel-default-base
kernel-docs
kernel-xen
kernel-default
kernel-trace
kernel-ec2
kernel-xen-devel-debuginfo
kernel-ec2-debuginfo
kernel-trace-devel-debuginfo
kernel-source
kernel-xen-debuginfo
kernel-default-devel-debuginfo
kernel-default-devel
kernel-ec2-devel
kernel-trace-debugsource
kernel-xen-devel
kernel-xen-debugsource
kernel-default-debugsource
kernel-ec2-debugsource
kernel-trace-debuginfo
kernel-ec2-devel-debuginfo
kernel-trace-base
kernel-debugsource
kernel-devel
python3-perf-debuginfo
python3-perf
perf-debuginfo
perf
kernel-tools-devel
kernel-tools-debuginfo
kernel-tools
kernel
bpftool
bpftool-debuginfo
kernel-debuginfo
kernel-headers
linux (Ubuntu package)
linux-aws (Ubuntu package)
linux-nvidia-tegra (Ubuntu package)
linux-nvidia-tegra-5.15 (Ubuntu package)
linux-intel-iot-realtime (Ubuntu package)
linux-intel-iotg (Ubuntu package)
linux-azure (Ubuntu package)
linux-azure-5.15 (Ubuntu package)
linux-gcp-5.15 (Ubuntu package)
linux-azure-fips (Ubuntu package)
linux-azure-fde (Ubuntu package)
kernel-extra-modules
linux-ibm (Ubuntu package)
linux-nvidia (Ubuntu package)
linux-nvidia-bos (Ubuntu package)

How to mitigate CVE-2026-64114

Install security update from vendor's repository.

Linux kernel - update to 7.0 rc3
kernel-syms - update to 3.0.101-108.216.1
kernel-xen-base - update to 3.0.101-108.216.1
kernel-ec2-base - update to 3.0.101-108.216.1
kernel-default-debuginfo - update to 3.0.101-108.216.1
kernel-trace-devel - update to 3.0.101-108.216.1
kernel-default-base - update to 3.0.101-108.216.1
kernel-docs - update to 3.0.101-108.216.1
kernel-xen - update to 3.0.101-108.216.1
kernel-default - update to 3.0.101-108.216.1
kernel-trace - update to 3.0.101-108.216.1
kernel-ec2 - update to 3.0.101-108.216.1
kernel-xen-devel-debuginfo - update to 3.0.101-108.216.1
kernel-ec2-debuginfo - update to 3.0.101-108.216.1
kernel-trace-devel-debuginfo - update to 3.0.101-108.216.1
kernel-source - update to 3.0.101-108.216.1
kernel-xen-debuginfo - update to 3.0.101-108.216.1
kernel-default-devel-debuginfo - update to 3.0.101-108.216.1
kernel-default-devel - update to 3.0.101-108.216.1
kernel-ec2-devel - update to 3.0.101-108.216.1
kernel-trace-debugsource - update to 3.0.101-108.216.1
kernel-xen-devel - update to 3.0.101-108.216.1
kernel-xen-debugsource - update to 3.0.101-108.216.1
kernel-default-debugsource - update to 3.0.101-108.216.1
kernel-ec2-debugsource - update to 3.0.101-108.216.1
kernel-trace-debuginfo - update to 3.0.101-108.216.1
kernel-ec2-devel-debuginfo - update to 3.0.101-108.216.1
kernel-trace-base - update to 3.0.101-108.216.1
kernel-debugsource - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-devel - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
python3-perf-debuginfo - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
python3-perf - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
perf-debuginfo - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
perf - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-tools-devel - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-tools-debuginfo - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-tools - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-source - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
bpftool - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
bpftool-debuginfo - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-debuginfo - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
kernel-headers - addressed in versions 5.10.0-330.0.0.231, 6.6.0-145.3.29.160
linux (Ubuntu package) - addressed in versions 5.15.0.184.155, 5.15.0-184.194, 5.15.0-184.194~20.04.1, 5.15.0.186.166, 5.15.0-186.196, 5.15.0-186.196~20.04.1, 5.15.0.1075.78, 5.15.0-1075.79, 5.15.0.1095.94, 5.15.0-1095.103, 5.15.0.1104.100, 5.15.0-1104.109, 5.15.0.1108.107, 5.15.0-1108.114, 5.15.0.1111.115, 5.15.0-1111.120+fips1, 5.15.0.1112.102, 5.15.0.1112.109, 5.15.0-1112.122, 5.15.0-1112.122+fips1
linux-aws (Ubuntu package) - addressed in versions 5.15.0.186.109, 5.15.0-186.196+fips1, 5.15.0.1106.103, 5.15.0-1106.110, 5.15.0.1107.107, 5.15.0-1107.108, 5.15.0.1112.108, 5.15.0.1112.115, 5.15.0-1112.119, 5.15.0-1112.119+fips1, 5.15.0-1112.119~20.04.1, 7.0.0-1009.9, 7.0.0-1015.15
linux-nvidia-tegra (Ubuntu package) - addressed in versions 5.15.0-1053.53, 5.15.0.1053.55, 5.15.0.1064.64, 5.15.0-1064.66
linux-nvidia-tegra-5.15 (Ubuntu package) - update to 5.15.0-1064.66~20.04.1
linux-intel-iot-realtime (Ubuntu package) - addressed in versions 5.15.0-1104.106, 5.15.0.1104.108, 5.15.0-1107.113~20.04.1
linux-intel-iotg (Ubuntu package) - addressed in versions 5.15.0.1107.106, 5.15.0-1107.113
linux-azure (Ubuntu package) - addressed in versions 5.15.0.1109.105, 5.15.0-1109.115, 5.15.0.1117.115, 5.15.0-1117.126, 7.0.0-1009.9, 7.0.0-1010.10
linux-azure-5.15 (Ubuntu package) - addressed in versions 5.15.0-1109.115~20.04.1, 5.15.0-1117.126~20.04.1, 5.15.0-1117.126~20.04.2
linux-gcp-5.15 (Ubuntu package) - update to 5.15.0-1112.122~20.04.1
linux-azure-fips (Ubuntu package) - addressed in versions 5.15.0.1117.102, 5.15.0-1117.126+fips1
linux-azure-fde (Ubuntu package) - update to 5.15.0-1117.126
kernel-extra-modules - update to 6.6.0-145.3.29.160
linux-ibm (Ubuntu package) - addressed in versions 7.0.0-1008.8, 7.0.0-1010.10
linux-nvidia (Ubuntu package) - addressed in versions 7.0.0-1016.16, 7.0.0-1016.16~24.04.1
linux-nvidia-bos (Ubuntu package) - update to 7.0.0-2016.16

External References

Related Security Bulletins