{"advisories":[{"id":"USN-8575-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8575-1"},{"id":"USN-8576-1","source":"usn","title":"Linux kernel (NVIDIA Tegra) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8576-1"},{"id":"USN-8593-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8593-1"},{"id":"USN-8575-2","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8575-2"},{"id":"USN-8576-2","source":"usn","title":"Linux kernel (NVIDIA Tegra) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8576-2"},{"id":"USN-8575-3","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8575-3"},{"id":"USN-8603-1","source":"usn","title":"Linux kernel (Azure) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8603-1"},{"id":"USN-8610-1","source":"usn","title":"Linux kernel (Azure CVM) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8610-1"},{"id":"USN-8618-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8618-1"},{"id":"USN-8620-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8620-1"},{"id":"USN-8620-2","source":"usn","title":"Linux kernel (Azure FIPS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8620-2"},{"id":"USN-8620-3","source":"usn","title":"Linux kernel (Intel IoTG) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8620-3"},{"id":"USN-8620-4","source":"usn","title":"Linux kernel (Intel IoTG) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8620-4"},{"id":"USN-8663-1","source":"usn","title":"Linux kernel (NVIDIA) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8663-1"},{"id":"USN-8664-1","source":"usn","title":"Linux kernel (NVIDIA BaseOS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8664-1"},{"id":"USN-8668-1","source":"usn","title":"Linux kernel (GCP) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8668-1"},{"id":"USN-8728-1","source":"usn","title":"Linux kernel (GCP) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8728-1"},{"id":"USN-8729-1","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-1"},{"id":"USN-8761-1","source":"usn","title":"Linux kernel (Azure) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8761-1"},{"id":"USN-8729-2","source":"usn","title":"Linux kernel (Raspberry Pi Real-time) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-2"},{"id":"USN-8761-2","source":"usn","title":"Linux kernel (Azure FIPS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8761-2"},{"id":"USN-8781-1","source":"usn","title":"Linux kernel (NVIDIA Tegra) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8781-1"},{"id":"USN-8668-2","source":"usn","title":"Linux kernel (Raspberry Pi) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8668-2"},{"id":"USN-8729-3","source":"usn","title":"Linux kernel vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-3"},{"id":"USN-8802-1","source":"usn","title":"Linux kernel (Oracle) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8802-1"},{"id":"USN-8728-2","source":"usn","title":"Linux kernel (Azure) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8728-2"},{"id":"USN-8729-4","source":"usn","title":"Linux kernel (Low Latency) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-4"},{"id":"USN-8729-5","source":"usn","title":"Linux kernel (AWS FIPS) vulnerabilities","url":"https://ubuntu.com/security/notices/USN-8729-5"}],"cve":"CVE-2026-64102","enrichment":{"affected":[{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[8b6a361b8c482f22ac99c3273285ff16b23fba91,683f7cfbf514193d63c0efa079f3352bde84c2e0)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[8b6a361b8c482f22ac99c3273285ff16b23fba91,4a331582011d9e8089af8aa2a61ec6b4443bb245)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[8b6a361b8c482f22ac99c3273285ff16b23fba91,33a8b5e971e294ec2a7b74211c545e09efd8e9ac)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[8b6a361b8c482f22ac99c3273285ff16b23fba91,14553be882d9ce91749c9d64041de66e34ad8e70)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[8b6a361b8c482f22ac99c3273285ff16b23fba91,c7c0c0f4379dedec12d24dbb9dded5d2db7fd9f2)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[8b6a361b8c482f22ac99c3273285ff16b23fba91,1012896f4225e8f801ff3c1648023845b66dfb11)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[8b6a361b8c482f22ac99c3273285ff16b23fba91,775b4dc9618a99a1fa48b57554041a5dc17e1336)"}},{"platform":null,"status":"affected","versions":{"scheme":"code_commit","value":"[8b6a361b8c482f22ac99c3273285ff16b23fba91,0ce1bc9e46ecabe84772bb561e373c0d9876d6f2)"}}],"enrichment":{"confidence":99.0,"confidence_source":"inferred","scores":[{"score":99.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"original":{"product":"Linux","source":"cna","vendor":"Linux"},"product":"linux_kernel","vendor":"linux"},{"configurations":[{"platform":null,"status":"affected","versions":{"scheme":"generic","value":"5.3"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[0,5.3)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[5.10.258,5.11.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[5.15.209,5.16.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.1.175,6.2.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.6.142,6.7.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.12.92,6.13.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[6.18.34,6.19.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"semver","value":"[7.0.11,7.1.0)"}},{"platform":null,"status":"unaffected","versions":{"scheme":"generic","value":"[7.1,*]"}}],"enrichment":{"confidence":99.0,"confidence_source":"inferred","scores":[{"score":99.0,"source":"inferred"},{"score":100.0,"source":"matching"}]},"original":{"product":"Linux","source":"cna","vendor":"Linux"},"product":"linux_kernel","vendor":"linux"}],"created":"2026-07-21T09:45:03.989582+00:00","updated":"2026-08-13T12:00:05.177006+00:00","vendors":["linux","linux$PRODUCT$linux_kernel"]},"epss":{"score":0.00734},"mitre":{"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"created":"2026-07-19T15:40:06.776000+00:00","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Reject MPA FPDU length underflow before signed receive math\n\nA malicious connected siw peer can send an iWARP FPDU whose MPA length\nfield (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller\nthan the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP\nparses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode]\n.hdr_len, but never compares mpa_len against that header length.\n\nsiw_tcp_rx_data() then derives\n\n    srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd\n                         + MPA_HDR_SIZE;\n\nwhere fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this\npoint. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest\non-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below\nhdr_len - MPA_HDR_SIZE underflows to a negative int.\n\nThe signed value then flows into siw_proc_write()/siw_proc_rresp() as\n\n    bytes = min(srx->fpdu_part_rem, srx->skb_new);\n\nis handed to siw_check_mem() as an int len (whose interval check\naddr + len > mem->va + mem->len is satisfied for a valid base when\nlen is negative), and reaches siw_rx_data() -> siw_rx_kva() /\nsiw_rx_umem() -> skb_copy_bits() as a signed copy length. The header\ncopy branch in skb_copy_bits() promotes that to size_t, producing a\nmulti-gigabyte read.\n\nKASAN under a KUnit harness that drives the real kernel TCP receive\npath -- a loopback AF_INET socketpair, the malformed FPDU written via\nkernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock\ndispatching to siw_tcp_rx_data -- reports:\n\n    BUG: KASAN: use-after-free in skb_copy_bits+0x284/0x480\n    Read of size 4294967295 at addr ffff888...\n    Call Trace:\n     skb_copy_bits\n     siw_rx_kva\n     siw_rx_data\n     siw_check_mem\n     siw_proc_write\n     siw_tcp_rx_data\n     __tcp_read_sock\n     siw_qp_llp_data_ready\n     tcp_data_ready\n     tcp_data_queue\n\nAdd the missing invariant at the earliest point where the peer header\nis fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly\nthe value the siw transmitter uses as the minimum mpa_len for each\nopcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the\nprotocol contract. Out-of-range FPDUs terminate the connection with\nTERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which\nis RFC 5044 Section 8 error code 3 (\"Marker and ULPDU Length fields\ndo not agree on the start of an FPDU\"), the correct framing-error\nclass for this inconsistency.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"mitre_repo_path":"cves/2026/64xxx/CVE-2026-64102.json","references":["https://git.kernel.org/stable/c/0ce1bc9e46ecabe84772bb561e373c0d9876d6f2","https://git.kernel.org/stable/c/1012896f4225e8f801ff3c1648023845b66dfb11","https://git.kernel.org/stable/c/14553be882d9ce91749c9d64041de66e34ad8e70","https://git.kernel.org/stable/c/33a8b5e971e294ec2a7b74211c545e09efd8e9ac","https://git.kernel.org/stable/c/4a331582011d9e8089af8aa2a61ec6b4443bb245","https://git.kernel.org/stable/c/683f7cfbf514193d63c0efa079f3352bde84c2e0","https://git.kernel.org/stable/c/775b4dc9618a99a1fa48b57554041a5dc17e1336","https://git.kernel.org/stable/c/c7c0c0f4379dedec12d24dbb9dded5d2db7fd9f2"],"title":"RDMA/siw: Reject MPA FPDU length underflow before signed receive math","updated":"2026-08-05T12:39:14.704000+00:00","vendors":["linux","linux$PRODUCT$linux_kernel"],"weaknesses":[]},"nvd":{"cpes":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"],"created":"2026-07-19T16:17:51.383000+00:00","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Reject MPA FPDU length underflow before signed receive math\n\nA malicious connected siw peer can send an iWARP FPDU whose MPA length\nfield (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller\nthan the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP\nparses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode]\n.hdr_len, but never compares mpa_len against that header length.\n\nsiw_tcp_rx_data() then derives\n\n    srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd\n                         + MPA_HDR_SIZE;\n\nwhere fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this\npoint. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest\non-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below\nhdr_len - MPA_HDR_SIZE underflows to a negative int.\n\nThe signed value then flows into siw_proc_write()/siw_proc_rresp() as\n\n    bytes = min(srx->fpdu_part_rem, srx->skb_new);\n\nis handed to siw_check_mem() as an int len (whose interval check\naddr + len > mem->va + mem->len is satisfied for a valid base when\nlen is negative), and reaches siw_rx_data() -> siw_rx_kva() /\nsiw_rx_umem() -> skb_copy_bits() as a signed copy length. The header\ncopy branch in skb_copy_bits() promotes that to size_t, producing a\nmulti-gigabyte read.\n\nKASAN under a KUnit harness that drives the real kernel TCP receive\npath -- a loopback AF_INET socketpair, the malformed FPDU written via\nkernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock\ndispatching to siw_tcp_rx_data -- reports:\n\n    BUG: KASAN: use-after-free in skb_copy_bits+0x284/0x480\n    Read of size 4294967295 at addr ffff888...\n    Call Trace:\n     skb_copy_bits\n     siw_rx_kva\n     siw_rx_data\n     siw_check_mem\n     siw_proc_write\n     siw_tcp_rx_data\n     __tcp_read_sock\n     siw_qp_llp_data_ready\n     tcp_data_ready\n     tcp_data_queue\n\nAdd the missing invariant at the earliest point where the peer header\nis fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly\nthe value the siw transmitter uses as the minimum mpa_len for each\nopcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the\nprotocol contract. Out-of-range FPDUs terminate the connection with\nTERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which\nis RFC 5044 Section 8 error code 3 (\"Marker and ULPDU Length fields\ndo not agree on the start of an FPDU\"), the correct framing-error\nclass for this inconsistency.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"cvssV4_0":{}},"nvd_repo_path":"2026/CVE-2026-64102.json","references":["https://git.kernel.org/stable/c/0ce1bc9e46ecabe84772bb561e373c0d9876d6f2","https://git.kernel.org/stable/c/1012896f4225e8f801ff3c1648023845b66dfb11","https://git.kernel.org/stable/c/14553be882d9ce91749c9d64041de66e34ad8e70","https://git.kernel.org/stable/c/33a8b5e971e294ec2a7b74211c545e09efd8e9ac","https://git.kernel.org/stable/c/4a331582011d9e8089af8aa2a61ec6b4443bb245","https://git.kernel.org/stable/c/683f7cfbf514193d63c0efa079f3352bde84c2e0","https://git.kernel.org/stable/c/775b4dc9618a99a1fa48b57554041a5dc17e1336","https://git.kernel.org/stable/c/c7c0c0f4379dedec12d24dbb9dded5d2db7fd9f2"],"title":null,"updated":"2026-08-12T15:49:23.140000+00:00","vendors":["linux","linux$PRODUCT$linux_kernel"],"weaknesses":["CWE-125"]},"opencve":{"changes":[{"created":"2026-07-19T16:15:00+00:00","data":[{"details":{"new":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Reject MPA FPDU length underflow before signed receive math\n\nA malicious connected siw peer can send an iWARP FPDU whose MPA length\nfield (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller\nthan the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP\nparses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode]\n.hdr_len, but never compares mpa_len against that header length.\n\nsiw_tcp_rx_data() then derives\n\n    srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd\n                         + MPA_HDR_SIZE;\n\nwhere fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this\npoint. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest\non-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below\nhdr_len - MPA_HDR_SIZE underflows to a negative int.\n\nThe signed value then flows into siw_proc_write()/siw_proc_rresp() as\n\n    bytes = min(srx->fpdu_part_rem, srx->skb_new);\n\nis handed to siw_check_mem() as an int len (whose interval check\naddr + len > mem->va + mem->len is satisfied for a valid base when\nlen is negative), and reaches siw_rx_data() -> siw_rx_kva() /\nsiw_rx_umem() -> skb_copy_bits() as a signed copy length. The header\ncopy branch in skb_copy_bits() promotes that to size_t, producing a\nmulti-gigabyte read.\n\nKASAN under a KUnit harness that drives the real kernel TCP receive\npath -- a loopback AF_INET socketpair, the malformed FPDU written via\nkernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock\ndispatching to siw_tcp_rx_data -- reports:\n\n    BUG: KASAN: use-after-free in skb_copy_bits+0x284/0x480\n    Read of size 4294967295 at addr ffff888...\n    Call Trace:\n     skb_copy_bits\n     siw_rx_kva\n     siw_rx_data\n     siw_check_mem\n     siw_proc_write\n     siw_tcp_rx_data\n     __tcp_read_sock\n     siw_qp_llp_data_ready\n     tcp_data_ready\n     tcp_data_queue\n\nAdd the missing invariant at the earliest point where the peer header\nis fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly\nthe value the siw transmitter uses as the minimum mpa_len for each\nopcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the\nprotocol contract. Out-of-range FPDUs terminate the connection with\nTERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which\nis RFC 5044 Section 8 error code 3 (\"Marker and ULPDU Length fields\ndo not agree on the start of an FPDU\"), the correct framing-error\nclass for this inconsistency.","old":null},"type":"description"},{"details":{"new":"RDMA/siw: Reject MPA FPDU length underflow before signed receive math","old":null},"type":"title"},{"details":["linux","linux$PRODUCT$linux_kernel"],"type":"first_time"},{"details":{"added":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"],"removed":[]},"type":"cpes"},{"details":{"added":["linux","linux$PRODUCT$linux_kernel"],"removed":[]},"type":"vendors"},{"details":{"added":["https://git.kernel.org/stable/c/0ce1bc9e46ecabe84772bb561e373c0d9876d6f2","https://git.kernel.org/stable/c/1012896f4225e8f801ff3c1648023845b66dfb11","https://git.kernel.org/stable/c/14553be882d9ce91749c9d64041de66e34ad8e70","https://git.kernel.org/stable/c/33a8b5e971e294ec2a7b74211c545e09efd8e9ac","https://git.kernel.org/stable/c/4a331582011d9e8089af8aa2a61ec6b4443bb245","https://git.kernel.org/stable/c/683f7cfbf514193d63c0efa079f3352bde84c2e0","https://git.kernel.org/stable/c/775b4dc9618a99a1fa48b57554041a5dc17e1336","https://git.kernel.org/stable/c/c7c0c0f4379dedec12d24dbb9dded5d2db7fd9f2"],"removed":[]},"type":"references"}],"id":"f07e0953-b3fa-47f1-b62e-bf8d51df2aa8"},{"created":"2026-07-20T14:45:00+00:00","data":[{"details":{"added":{"cvssV3_1":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}},"removed":{},"updated":{}},"type":"metrics"}],"id":"650b37e4-3d24-465b-b4b6-86af6457ae32"},{"created":"2026-07-21T12:15:00+00:00","data":[{"details":{"added":["CWE-825"],"removed":[]},"type":"weaknesses"},{"details":{"added":["https://lore.kernel.org/linux-cve-announce/2026071920-CVE-2026-64102-dcb6@gregkh/T","https://nvd.nist.gov/vuln/detail/CVE-2026-64102","https://www.cve.org/CVERecord?id=CVE-2026-64102"],"removed":[]},"type":"references"},{"details":{"added":{},"removed":{},"updated":{"threat_severity":{"new":"Moderate","old":null}}},"type":"metrics"}],"id":"50ec04da-9fc1-4828-ac51-89d77134f1f8"},{"created":"2026-07-21T22:15:00+00:00","data":[{"details":{"added":["CWE-125","CWE-193"],"removed":[]},"type":"weaknesses"}],"id":"fe7233db-28c5-4013-a7dc-dfc56f447612"},{"created":"2026-07-26T08:15:00+00:00","data":[{"details":{"added":[],"removed":["CWE-125","CWE-193"]},"type":"weaknesses"}],"id":"d9e0d922-5556-4419-8863-84730d6332b6"},{"created":"2026-08-12T16:00:00+00:00","data":[{"details":{"added":["CWE-125"],"removed":[]},"type":"weaknesses"},{"details":{"added":["cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"],"removed":[]},"type":"cpes"}],"id":"5a0be54a-8313-4b2f-8d7a-b4435c0853eb"}],"cpes":{"data":["cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*","cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"],"providers":["mitre","nvd"]},"created":{"data":"2026-07-19T00:00:00+00:00","provider":"redhat"},"description":{"data":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Reject MPA FPDU length underflow before signed receive math\n\nA malicious connected siw peer can send an iWARP FPDU whose MPA length\nfield (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller\nthan the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP\nparses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode]\n.hdr_len, but never compares mpa_len against that header length.\n\nsiw_tcp_rx_data() then derives\n\n    srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd\n                         + MPA_HDR_SIZE;\n\nwhere fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this\npoint. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest\non-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below\nhdr_len - MPA_HDR_SIZE underflows to a negative int.\n\nThe signed value then flows into siw_proc_write()/siw_proc_rresp() as\n\n    bytes = min(srx->fpdu_part_rem, srx->skb_new);\n\nis handed to siw_check_mem() as an int len (whose interval check\naddr + len > mem->va + mem->len is satisfied for a valid base when\nlen is negative), and reaches siw_rx_data() -> siw_rx_kva() /\nsiw_rx_umem() -> skb_copy_bits() as a signed copy length. The header\ncopy branch in skb_copy_bits() promotes that to size_t, producing a\nmulti-gigabyte read.\n\nKASAN under a KUnit harness that drives the real kernel TCP receive\npath -- a loopback AF_INET socketpair, the malformed FPDU written via\nkernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock\ndispatching to siw_tcp_rx_data -- reports:\n\n    BUG: KASAN: use-after-free in skb_copy_bits+0x284/0x480\n    Read of size 4294967295 at addr ffff888...\n    Call Trace:\n     skb_copy_bits\n     siw_rx_kva\n     siw_rx_data\n     siw_check_mem\n     siw_proc_write\n     siw_tcp_rx_data\n     __tcp_read_sock\n     siw_qp_llp_data_ready\n     tcp_data_ready\n     tcp_data_queue\n\nAdd the missing invariant at the earliest point where the peer header\nis fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly\nthe value the siw transmitter uses as the minimum mpa_len for each\nopcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the\nprotocol contract. Out-of-range FPDUs terminate the connection with\nTERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which\nis RFC 5044 Section 8 error code 3 (\"Marker and ULPDU Length fields\ndo not agree on the start of an FPDU\"), the correct framing-error\nclass for this inconsistency.","provider":"mitre"},"metrics":{"cvssV2_0":{"data":{},"provider":null},"cvssV3_0":{"data":{},"provider":null},"cvssV3_1":{"data":{"score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"},"provider":"mitre"},"cvssV4_0":{"data":{},"provider":null},"epss":{"data":{"score":0.00734},"provider":"first"},"kev":{"data":{},"provider":null},"ssvc":{"data":{},"provider":null},"threat_severity":{"data":"Moderate","provider":"redhat"}},"references":{"data":["https://git.kernel.org/stable/c/0ce1bc9e46ecabe84772bb561e373c0d9876d6f2","https://git.kernel.org/stable/c/1012896f4225e8f801ff3c1648023845b66dfb11","https://git.kernel.org/stable/c/14553be882d9ce91749c9d64041de66e34ad8e70","https://git.kernel.org/stable/c/33a8b5e971e294ec2a7b74211c545e09efd8e9ac","https://git.kernel.org/stable/c/4a331582011d9e8089af8aa2a61ec6b4443bb245","https://git.kernel.org/stable/c/683f7cfbf514193d63c0efa079f3352bde84c2e0","https://git.kernel.org/stable/c/775b4dc9618a99a1fa48b57554041a5dc17e1336","https://git.kernel.org/stable/c/c7c0c0f4379dedec12d24dbb9dded5d2db7fd9f2","https://lore.kernel.org/linux-cve-announce/2026071920-CVE-2026-64102-dcb6@gregkh/T","https://nvd.nist.gov/vuln/detail/CVE-2026-64102","https://www.cve.org/CVERecord?id=CVE-2026-64102"],"providers":["mitre","nvd","redhat"]},"title":{"data":"RDMA/siw: Reject MPA FPDU length underflow before signed receive math","provider":"mitre"},"updated":{"data":"2026-08-12T15:49:23.140000+00:00","provider":"nvd"},"vendors":{"data":["linux","linux$PRODUCT$linux_kernel"],"providers":["mitre","nvd","enrichment"]},"weaknesses":{"data":["CWE-125","CWE-825"],"providers":["nvd","redhat"]}},"redhat":{"cpes":[],"created":"2026-07-19T00:00:00+00:00","description":"In the Linux kernel, the following vulnerability has been resolved:\nRDMA/siw: Reject MPA FPDU length underflow before signed receive math\nA malicious connected siw peer can send an iWARP FPDU whose MPA length\nfield (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller\nthan the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP\nparses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode]\n.hdr_len, but never compares mpa_len against that header length.\nsiw_tcp_rx_data() then derives\nsrx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd\n+ MPA_HDR_SIZE;\nwhere fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this\npoint. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest\non-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below\nhdr_len - MPA_HDR_SIZE underflows to a negative int.\nThe signed value then flows into siw_proc_write()/siw_proc_rresp() as\nbytes = min(srx->fpdu_part_rem, srx->skb_new);\nis handed to siw_check_mem() as an int len (whose interval check\naddr + len > mem->va + mem->len is satisfied for a valid base when\nlen is negative), and reaches siw_rx_data() -> siw_rx_kva() /\nsiw_rx_umem() -> skb_copy_bits() as a signed copy length. The header\ncopy branch in skb_copy_bits() promotes that to size_t, producing a\nmulti-gigabyte read.\nKASAN under a KUnit harness that drives the real kernel TCP receive\npath -- a loopback AF_INET socketpair, the malformed FPDU written via\nkernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock\ndispatching to siw_tcp_rx_data -- reports:\nBUG: KASAN: use-after-free in skb_copy_bits+0x284/0x480\nRead of size 4294967295 at addr ffff888...\nCall Trace:\nskb_copy_bits\nsiw_rx_kva\nsiw_rx_data\nsiw_check_mem\nsiw_proc_write\nsiw_tcp_rx_data\n__tcp_read_sock\nsiw_qp_llp_data_ready\ntcp_data_ready\ntcp_data_queue\nAdd the missing invariant at the earliest point where the peer header\nis fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly\nthe value the siw transmitter uses as the minimum mpa_len for each\nopcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the\nprotocol contract. Out-of-range FPDUs terminate the connection with\nTERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which\nis RFC 5044 Section 8 error code 3 (\"Marker and ULPDU Length fields\ndo not agree on the start of an FPDU\"), the correct framing-error\nclass for this inconsistency.","metrics":{"cvssV2_0":{},"cvssV3_0":{},"cvssV3_1":{"score":7.0,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"},"threat_severity":"Moderate"},"redhat_repo_path":"2026/CVE-2026-64102.json","references":["https://lore.kernel.org/linux-cve-announce/2026071920-CVE-2026-64102-dcb6@gregkh/T","https://nvd.nist.gov/vuln/detail/CVE-2026-64102","https://www.cve.org/CVERecord?id=CVE-2026-64102"],"title":"kernel: RDMA/siw: Reject MPA FPDU length underflow before signed receive math","updated":"2026-07-19T00:00:00+00:00","vendors":[],"weaknesses":["CWE-825"]}}