Integer underflow in Linux kernel - CVE-2026-64102
Published: July 20, 2026
Vulnerability identifier: #VU138534
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2026-64102
CWE-ID: CWE-191
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Linux Foundation
Affected software:
Linux kernel
Linux kernel
Detailed vulnerability description
The vulnerability allows a remote user to cause a denial of service and disclose kernel memory contents.
The vulnerability exists due to an integer underflow in the Soft-iWARP receive path (siw_get_hdr/siw_tcp_rx_data) when processing a malformed iWARP FPDU with an MPA length smaller than the fixed header length for the opcode. A remote user can send a specially crafted FPDU to cause a denial of service and disclose kernel memory contents.
The issue is triggered by a malicious connected siw peer, and the negative signed length is later promoted to size_t during skb_copy_bits processing.
How to mitigate CVE-2026-64102
Install security update from vendor's repository.
Sources
- https://git.kernel.org/stable/c/0ce1bc9e46ecabe84772bb561e373c0d9876d6f2
- https://git.kernel.org/stable/c/1012896f4225e8f801ff3c1648023845b66dfb11
- https://git.kernel.org/stable/c/14553be882d9ce91749c9d64041de66e34ad8e70
- https://git.kernel.org/stable/c/33a8b5e971e294ec2a7b74211c545e09efd8e9ac
- https://git.kernel.org/stable/c/4a331582011d9e8089af8aa2a61ec6b4443bb245
- https://git.kernel.org/stable/c/683f7cfbf514193d63c0efa079f3352bde84c2e0
- https://git.kernel.org/stable/c/775b4dc9618a99a1fa48b57554041a5dc17e1336
- https://git.kernel.org/stable/c/c7c0c0f4379dedec12d24dbb9dded5d2db7fd9f2