cve-2026-64114
HIGH CVSS 7.8 opencve
Description
In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 raw_send_hdrinc() validates that the caller-supplied IPv4 header fits within the message length: iphlen = iph->ihl * 4; err = -EINVAL; if (iphlen > length) goto error_free; if (iphlen >= sizeof(*iph)) { /* fix up saddr, tot_len, id, csum, transport_header */ } It does not, however, reject ihl < 5. For such a packet the "if (iphlen >= sizeof(*iph))" branch is skipped, leaving the crafted iphdr untouched, but the packet is still handed to __ip_local_out() and onward. Downstream consumers that read iph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in particular subtracts sizeof(struct iphdr) from top_iph->ihl * 4 and passes the (signed-int-negative, then cast to size_t) result to memcpy(), producing an OOB access of length close to SIZE_MAX and a host kernel panic. An IPv4 header with ihl < 5 is malformed by definition (RFC 791: "Internet Header Length is the length of the internet header in 32 bit words ... Note that the minimum value for a correct header is 5."). The kernel should not be willing to inject such a packet into its own output path. Reject "iphlen < sizeof(*iph)" alongside the existing "iphlen > length" check. This matches the principle that locally constructed packets that re-enter the IP stack must pass the same basic sanity tests that a foreign packet would be subjected to. Once this lands, the "if (iphlen >= sizeof(*iph))" wrapper around the fixup branch becomes redundant; left in place to keep the patch minimal and backport-friendly. A follow-up can unwrap it. Note that commit 86f4c90a1c5c ("ipv4, ipv6: ensure raw socket message is big enough to hold an IP header") ensures the message buffer is large enough to hold an iphdr, but does not constrain the self-reported iph->ihl. Reachability: the malformed packet source is any caller with CAP_NET_RAW, including an unprivileged process in a user+net namespace on a kernel with CONFIG_USER_NS=y. The reproduced AH crash also requires a matching xfrm AH policy on the outgoing route; a container granted CAP_NET_ADMIN can install that state and policy in its netns. Loopback bypasses xfrm_output, so the trigger uses a real netdev. Reproduced on UML + KASAN: kernel-mode fault at addr 0x0 with memcpy_orig at the crash site. Same shape reproduces inside a rootless Docker container with --cap-add NET_ADMIN on a stock distro kernel.
Timeline
- Published
- 2026-07-19 16:17 UTC
- Last Modified
- 2026-08-12
CVSS Details
CVSS details not available.
Affected Products
No product information available.
CVSS metrics
| Version | Base | Severity | Vector | Exploitability | Impact | Source |
|---|---|---|---|---|---|---|
| 3.1 | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
mitre | ||
| 3.1 | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
nvd | ||
| 3.1 | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
opencve | ||
| 3.1 | 7.0 | HIGH | CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
redhat |
References
No references available.
Linked Vulnerabilities
{
"advisories": [
{
"id": "USN-8575-1",
"source": "usn",
"title": "Linux kernel vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8575-1"
},
{
"id": "USN-8576-1",
"source": "usn",
"title": "Linux kernel (NVIDIA Tegra) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8576-1"
},
{
"id": "USN-8593-1",
"source": "usn",
"title": "Linux kernel vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8593-1"
},
{
"id": "USN-8575-2",
"source": "usn",
"title": "Linux kernel vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8575-2"
},
{
"id": "USN-8576-2",
"source": "usn",
"title": "Linux kernel (NVIDIA Tegra) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8576-2"
},
{
"id": "USN-8575-3",
"source": "usn",
"title": "Linux kernel vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8575-3"
},
{
"id": "USN-8603-1",
"source": "usn",
"title": "Linux kernel (Azure) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8603-1"
},
{
"id": "USN-8610-1",
"source": "usn",
"title": "Linux kernel (Azure CVM) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8610-1"
},
{
"id": "USN-8618-1",
"source": "usn",
"title": "Linux kernel vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8618-1"
},
{
"id": "USN-8620-1",
"source": "usn",
"title": "Linux kernel vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8620-1"
},
{
"id": "USN-8620-2",
"source": "usn",
"title": "Linux kernel (Azure FIPS) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8620-2"
},
{
"id": "USN-8620-3",
"source": "usn",
"title": "Linux kernel (Intel IoTG) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8620-3"
},
{
"id": "USN-8620-4",
"source": "usn",
"title": "Linux kernel (Intel IoTG) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8620-4"
},
{
"id": "USN-8663-1",
"source": "usn",
"title": "Linux kernel (NVIDIA) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8663-1"
},
{
"id": "USN-8664-1",
"source": "usn",
"title": "Linux kernel (NVIDIA BaseOS) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8664-1"
},
{
"id": "USN-8668-1",
"source": "usn",
"title": "Linux kernel (GCP) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8668-1"
},
{
"id": "USN-8728-1",
"source": "usn",
"title": "Linux kernel (GCP) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8728-1"
},
{
"id": "USN-8729-1",
"source": "usn",
"title": "Linux kernel vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8729-1"
},
{
"id": "USN-8761-1",
"source": "usn",
"title": "Linux kernel (Azure) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8761-1"
},
{
"id": "USN-8729-2",
"source": "usn",
"title": "Linux kernel (Raspberry Pi Real-time) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8729-2"
},
{
"id": "USN-8761-2",
"source": "usn",
"title": "Linux kernel (Azure FIPS) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8761-2"
},
{
"id": "USN-8781-1",
"source": "usn",
"title": "Linux kernel (NVIDIA Tegra) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8781-1"
},
{
"id": "USN-8668-2",
"source": "usn",
"title": "Linux kernel (Raspberry Pi) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8668-2"
},
{
"id": "USN-8729-3",
"source": "usn",
"title": "Linux kernel vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8729-3"
},
{
"id": "USN-8802-1",
"source": "usn",
"title": "Linux kernel (Oracle) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8802-1"
},
{
"id": "USN-8728-2",
"source": "usn",
"title": "Linux kernel (Azure) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8728-2"
},
{
"id": "USN-8729-4",
"source": "usn",
"title": "Linux kernel (Low Latency) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8729-4"
},
{
"id": "USN-8729-5",
"source": "usn",
"title": "Linux kernel (AWS FIPS) vulnerabilities",
"url": "https://ubuntu.com/security/notices/USN-8729-5"
}
],
"cve": "CVE-2026-64114",
"enrichment": {
"affected": [
{
"configurations": [
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "code_commit",
"value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,1065b9efa4126df559b03a849c139ecfae92cd25)"
}
},
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "code_commit",
"value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bc20dbd48c26e743f7e0845020c11ed2ce8b15ee)"
}
},
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "code_commit",
"value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,5a564f737ec54d63e8ee221d3ff396d07586d464)"
}
},
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "code_commit",
"value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,3c5411fa4944ed99af3d9d1de750ea8169b6dac9)"
}
},
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "code_commit",
"value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,145e9afa5b905229b4788bb72c3255f5a5f77508)"
}
},
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "code_commit",
"value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,7725cd3b471740fd23d25ed1da722c671fb2a5d3)"
}
},
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "code_commit",
"value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,915fab69823a14c170dbaa3b41978768e0fe62fc)"
}
},
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "code_commit",
"value": "[1da177e4c3f41524e886b7f1b8a0c1fc7321cac2,bbe0be67de296176e7243c76e3d9f02f6ae9ff0b)"
}
}
],
"enrichment": {
"confidence": 99.0,
"confidence_source": "inferred",
"scores": [
{
"score": 99.0,
"source": "inferred"
},
{
"score": 100.0,
"source": "matching"
}
]
},
"original": {
"product": "Linux",
"source": "cna",
"vendor": "Linux"
},
"product": "linux_kernel",
"vendor": "linux"
},
{
"configurations": [
{
"platform": null,
"status": "affected",
"versions": {
"scheme": "semver",
"value": "2.6.12"
}
},
{
"platform": null,
"status": "unaffected",
"versions": {
"scheme": "semver",
"value": "[0,2.6.12)"
}
},
{
"platform": null,
"status": "unaffected",
"versions": {
"scheme": "semver",
"value": "[5.10.258,5.11.0)"
}
},
{
"platform": null,
"status": "unaffected",
"versions": {
"scheme": "semver",
"value": "[5.15.209,5.16.0)"
}
},
{
"platform": null,
"status": "unaffected",
"versions": {
"scheme": "semver",
"value": "[6.1.175,6.2.0)"
}
},
{
"platform": null,
"status": "unaffected",
"versions": {
"scheme": "semver",
"value": "[6.6.142,6.7.0)"
}
},
{
"platform": null,
"status": "unaffected",
"versions": {
"scheme": "semver",
"value": "[6.12.92,6.13.0)"
}
},
{
"platform": null,
"status": "unaffected",
"versions": {
"scheme": "semver",
"value": "[6.18.34,6.19.0)"
}
},
{
"platform": null,
"status": "unaffected",
"versions": {
"scheme": "semver",
"value": "[7.0.11,7.1.0)"
}
},
{
"platform": null,
"status": "unaffected",
"versions": {
"scheme": "generic",
"value": "[7.1,*]"
}
}
],
"enrichment": {
"confidence": 99.0,
"confidence_source": "inferred",
"scores": [
{
"score": 99.0,
"source": "inferred"
},
{
"score": 100.0,
"source": "matching"
}
]
},
"original": {
"product": "Linux",
"source": "cna",
"vendor": "Linux"
},
"product": "linux_kernel",
"vendor": "linux"
}
],
"created": "2026-07-21T10:45:02.435520+00:00",
"updated": "2026-08-13T12:00:05.162610+00:00",
"vendors": [
"linux",
"linux$PRODUCT$linux_kernel"
]
},
"epss": {
"score": 0.00185
},
"mitre": {
"cpes": [
"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
],
"created": "2026-07-19T15:40:14.854000+00:00",
"description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: raw: reject IP_HDRINCL packets with ihl < 5\n\nraw_send_hdrinc() validates that the caller-supplied IPv4 header\nfits within the message length:\n\n iphlen = iph->ihl * 4;\n err = -EINVAL;\n if (iphlen > length)\n goto error_free;\n\n if (iphlen >= sizeof(*iph)) {\n /* fix up saddr, tot_len, id, csum, transport_header */\n }\n\nIt does not, however, reject ihl < 5. For such a packet the\n\"if (iphlen >= sizeof(*iph))\" branch is skipped, leaving the\ncrafted iphdr untouched, but the packet is still handed to\n__ip_local_out() and onward. Downstream consumers that read\niph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in\nparticular subtracts sizeof(struct iphdr) from top_iph->ihl * 4\nand passes the (signed-int-negative, then cast to size_t)\nresult to memcpy(), producing an OOB access of length close to\nSIZE_MAX and a host kernel panic.\n\nAn IPv4 header with ihl < 5 is malformed by definition (RFC 791:\n\"Internet Header Length is the length of the internet header in\n32 bit words ... Note that the minimum value for a correct header\nis 5.\"). The kernel should not be willing to inject such a\npacket into its own output path.\n\nReject \"iphlen < sizeof(*iph)\" alongside the existing\n\"iphlen > length\" check. This matches the principle that locally\nconstructed packets that re-enter the IP stack must pass the same\nbasic sanity tests that a foreign packet would be subjected to.\n\nOnce this lands, the \"if (iphlen >= sizeof(*iph))\" wrapper around\nthe fixup branch becomes redundant; left in place to keep the\npatch minimal and backport-friendly. A follow-up can unwrap it.\n\nNote that commit 86f4c90a1c5c (\"ipv4, ipv6: ensure raw socket\nmessage is big enough to hold an IP header\") ensures the message\nbuffer is large enough to hold an iphdr, but does not constrain\nthe self-reported iph->ihl.\n\nReachability: the malformed packet source is any caller with\nCAP_NET_RAW, including an unprivileged process in a user+net\nnamespace on a kernel with CONFIG_USER_NS=y. The reproduced AH\ncrash also requires a matching xfrm AH policy on the outgoing\nroute; a container granted CAP_NET_ADMIN can install that state\nand policy in its netns. Loopback bypasses xfrm_output, so the\ntrigger uses a real netdev.\n\nReproduced on UML + KASAN: kernel-mode fault at addr 0x0 with\nmemcpy_orig at the crash site. Same shape reproduces inside a\nrootless Docker container with --cap-add NET_ADMIN on a stock\ndistro kernel.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 7.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"mitre_repo_path": "cves/2026/64xxx/CVE-2026-64114.json",
"references": [
"https://git.kernel.org/stable/c/1065b9efa4126df559b03a849c139ecfae92cd25",
"https://git.kernel.org/stable/c/145e9afa5b905229b4788bb72c3255f5a5f77508",
"https://git.kernel.org/stable/c/3c5411fa4944ed99af3d9d1de750ea8169b6dac9",
"https://git.kernel.org/stable/c/5a564f737ec54d63e8ee221d3ff396d07586d464",
"https://git.kernel.org/stable/c/7725cd3b471740fd23d25ed1da722c671fb2a5d3",
"https://git.kernel.org/stable/c/915fab69823a14c170dbaa3b41978768e0fe62fc",
"https://git.kernel.org/stable/c/bbe0be67de296176e7243c76e3d9f02f6ae9ff0b",
"https://git.kernel.org/stable/c/bc20dbd48c26e743f7e0845020c11ed2ce8b15ee"
],
"title": "ipv4: raw: reject IP_HDRINCL packets with ihl < 5",
"updated": "2026-08-05T12:39:23.263000+00:00",
"vendors": [
"linux",
"linux$PRODUCT$linux_kernel"
],
"weaknesses": []
},
"nvd": {
"cpes": [
"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"
],
"created": "2026-07-19T16:17:52.820000+00:00",
"description": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: raw: reject IP_HDRINCL packets with ihl < 5\n\nraw_send_hdrinc() validates that the caller-supplied IPv4 header\nfits within the message length:\n\n iphlen = iph->ihl * 4;\n err = -EINVAL;\n if (iphlen > length)\n goto error_free;\n\n if (iphlen >= sizeof(*iph)) {\n /* fix up saddr, tot_len, id, csum, transport_header */\n }\n\nIt does not, however, reject ihl < 5. For such a packet the\n\"if (iphlen >= sizeof(*iph))\" branch is skipped, leaving the\ncrafted iphdr untouched, but the packet is still handed to\n__ip_local_out() and onward. Downstream consumers that read\niph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in\nparticular subtracts sizeof(struct iphdr) from top_iph->ihl * 4\nand passes the (signed-int-negative, then cast to size_t)\nresult to memcpy(), producing an OOB access of length close to\nSIZE_MAX and a host kernel panic.\n\nAn IPv4 header with ihl < 5 is malformed by definition (RFC 791:\n\"Internet Header Length is the length of the internet header in\n32 bit words ... Note that the minimum value for a correct header\nis 5.\"). The kernel should not be willing to inject such a\npacket into its own output path.\n\nReject \"iphlen < sizeof(*iph)\" alongside the existing\n\"iphlen > length\" check. This matches the principle that locally\nconstructed packets that re-enter the IP stack must pass the same\nbasic sanity tests that a foreign packet would be subjected to.\n\nOnce this lands, the \"if (iphlen >= sizeof(*iph))\" wrapper around\nthe fixup branch becomes redundant; left in place to keep the\npatch minimal and backport-friendly. A follow-up can unwrap it.\n\nNote that commit 86f4c90a1c5c (\"ipv4, ipv6: ensure raw socket\nmessage is big enough to hold an IP header\") ensures the message\nbuffer is large enough to hold an iphdr, but does not constrain\nthe self-reported iph->ihl.\n\nReachability: the malformed packet source is any caller with\nCAP_NET_RAW, including an unprivileged process in a user+net\nnamespace on a kernel with CONFIG_USER_NS=y. The reproduced AH\ncrash also requires a matching xfrm AH policy on the outgoing\nroute; a container granted CAP_NET_ADMIN can install that state\nand policy in its netns. Loopback bypasses xfrm_output, so the\ntrigger uses a real netdev.\n\nReproduced on UML + KASAN: kernel-mode fault at addr 0x0 with\nmemcpy_orig at the crash site. Same shape reproduces inside a\nrootless Docker container with --cap-add NET_ADMIN on a stock\ndistro kernel.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 7.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"cvssV4_0": {}
},
"nvd_repo_path": "2026/CVE-2026-64114.json",
"references": [
"https://git.kernel.org/stable/c/1065b9efa4126df559b03a849c139ecfae92cd25",
"https://git.kernel.org/stable/c/145e9afa5b905229b4788bb72c3255f5a5f77508",
"https://git.kernel.org/stable/c/3c5411fa4944ed99af3d9d1de750ea8169b6dac9",
"https://git.kernel.org/stable/c/5a564f737ec54d63e8ee221d3ff396d07586d464",
"https://git.kernel.org/stable/c/7725cd3b471740fd23d25ed1da722c671fb2a5d3",
"https://git.kernel.org/stable/c/915fab69823a14c170dbaa3b41978768e0fe62fc",
"https://git.kernel.org/stable/c/bbe0be67de296176e7243c76e3d9f02f6ae9ff0b",
"https://git.kernel.org/stable/c/bc20dbd48c26e743f7e0845020c11ed2ce8b15ee"
],
"title": null,
"updated": "2026-08-12T15:50:21.120000+00:00",
"vendors": [
"linux",
"linux$PRODUCT$linux_kernel"
],
"weaknesses": [
"CWE-125"
]
},
"opencve": {
"changes": [
{
"created": "2026-07-19T16:15:00+00:00",
"data": [
{
"details": {
"new": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: raw: reject IP_HDRINCL packets with ihl < 5\n\nraw_send_hdrinc() validates that the caller-supplied IPv4 header\nfits within the message length:\n\n iphlen = iph->ihl * 4;\n err = -EINVAL;\n if (iphlen > length)\n goto error_free;\n\n if (iphlen >= sizeof(*iph)) {\n /* fix up saddr, tot_len, id, csum, transport_header */\n }\n\nIt does not, however, reject ihl < 5. For such a packet the\n\"if (iphlen >= sizeof(*iph))\" branch is skipped, leaving the\ncrafted iphdr untouched, but the packet is still handed to\n__ip_local_out() and onward. Downstream consumers that read\niph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in\nparticular subtracts sizeof(struct iphdr) from top_iph->ihl * 4\nand passes the (signed-int-negative, then cast to size_t)\nresult to memcpy(), producing an OOB access of length close to\nSIZE_MAX and a host kernel panic.\n\nAn IPv4 header with ihl < 5 is malformed by definition (RFC 791:\n\"Internet Header Length is the length of the internet header in\n32 bit words ... Note that the minimum value for a correct header\nis 5.\"). The kernel should not be willing to inject such a\npacket into its own output path.\n\nReject \"iphlen < sizeof(*iph)\" alongside the existing\n\"iphlen > length\" check. This matches the principle that locally\nconstructed packets that re-enter the IP stack must pass the same\nbasic sanity tests that a foreign packet would be subjected to.\n\nOnce this lands, the \"if (iphlen >= sizeof(*iph))\" wrapper around\nthe fixup branch becomes redundant; left in place to keep the\npatch minimal and backport-friendly. A follow-up can unwrap it.\n\nNote that commit 86f4c90a1c5c (\"ipv4, ipv6: ensure raw socket\nmessage is big enough to hold an IP header\") ensures the message\nbuffer is large enough to hold an iphdr, but does not constrain\nthe self-reported iph->ihl.\n\nReachability: the malformed packet source is any caller with\nCAP_NET_RAW, including an unprivileged process in a user+net\nnamespace on a kernel with CONFIG_USER_NS=y. The reproduced AH\ncrash also requires a matching xfrm AH policy on the outgoing\nroute; a container granted CAP_NET_ADMIN can install that state\nand policy in its netns. Loopback bypasses xfrm_output, so the\ntrigger uses a real netdev.\n\nReproduced on UML + KASAN: kernel-mode fault at addr 0x0 with\nmemcpy_orig at the crash site. Same shape reproduces inside a\nrootless Docker container with --cap-add NET_ADMIN on a stock\ndistro kernel.",
"old": null
},
"type": "description"
},
{
"details": {
"new": "ipv4: raw: reject IP_HDRINCL packets with ihl < 5",
"old": null
},
"type": "title"
},
{
"details": [
"linux",
"linux$PRODUCT$linux_kernel"
],
"type": "first_time"
},
{
"details": {
"added": [
"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*"
],
"removed": []
},
"type": "cpes"
},
{
"details": {
"added": [
"linux",
"linux$PRODUCT$linux_kernel"
],
"removed": []
},
"type": "vendors"
},
{
"details": {
"added": [
"https://git.kernel.org/stable/c/1065b9efa4126df559b03a849c139ecfae92cd25",
"https://git.kernel.org/stable/c/145e9afa5b905229b4788bb72c3255f5a5f77508",
"https://git.kernel.org/stable/c/3c5411fa4944ed99af3d9d1de750ea8169b6dac9",
"https://git.kernel.org/stable/c/5a564f737ec54d63e8ee221d3ff396d07586d464",
"https://git.kernel.org/stable/c/7725cd3b471740fd23d25ed1da722c671fb2a5d3",
"https://git.kernel.org/stable/c/915fab69823a14c170dbaa3b41978768e0fe62fc",
"https://git.kernel.org/stable/c/bbe0be67de296176e7243c76e3d9f02f6ae9ff0b",
"https://git.kernel.org/stable/c/bc20dbd48c26e743f7e0845020c11ed2ce8b15ee"
],
"removed": []
},
"type": "references"
}
],
"id": "6520f68c-760c-4dba-9b44-c34869419af7"
},
{
"created": "2026-07-20T14:45:00+00:00",
"data": [
{
"details": {
"added": {
"cvssV3_1": {
"score": 7.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
}
},
"removed": {},
"updated": {}
},
"type": "metrics"
}
],
"id": "25ee9ad3-da2c-4928-b6ca-cc0389d5cb90"
},
{
"created": "2026-07-21T12:15:00+00:00",
"data": [
{
"details": {
"added": [
"CWE-805"
],
"removed": []
},
"type": "weaknesses"
},
{
"details": {
"added": [
"https://lore.kernel.org/linux-cve-announce/2026071923-CVE-2026-64114-d584@gregkh/T",
"https://nvd.nist.gov/vuln/detail/CVE-2026-64114",
"https://www.cve.org/CVERecord?id=CVE-2026-64114"
],
"removed": []
},
"type": "references"
},
{
"details": {
"added": {},
"removed": {},
"updated": {
"threat_severity": {
"new": "Moderate",
"old": null
}
}
},
"type": "metrics"
}
],
"id": "6675ee42-fb2f-444b-b543-ac580ba574c0"
},
{
"created": "2026-07-21T22:15:00+00:00",
"data": [
{
"details": {
"added": [
"CWE-20"
],
"removed": []
},
"type": "weaknesses"
}
],
"id": "0a7bd656-c538-4bbf-b3a0-71406b1f0e69"
},
{
"created": "2026-07-26T08:15:00+00:00",
"data": [
{
"details": {
"added": [],
"removed": [
"CWE-20"
]
},
"type": "weaknesses"
}
],
"id": "d75fc9cd-4057-416f-90e1-49061b539531"
},
{
"created": "2026-08-12T16:00:00+00:00",
"data": [
{
"details": {
"added": [
"CWE-125"
],
"removed": []
},
"type": "weaknesses"
},
{
"details": {
"added": [
"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"
],
"removed": []
},
"type": "cpes"
}
],
"id": "5b765000-81f1-4d71-abb6-3c6d5fcf2374"
}
],
"cpes": {
"data": [
"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:2.6.12:-:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:2.6.12:rc2:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:2.6.12:rc3:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:2.6.12:rc4:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:2.6.12:rc5:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
"cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*"
],
"providers": [
"mitre",
"nvd"
]
},
"created": {
"data": "2026-07-19T00:00:00+00:00",
"provider": "redhat"
},
"description": {
"data": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: raw: reject IP_HDRINCL packets with ihl < 5\n\nraw_send_hdrinc() validates that the caller-supplied IPv4 header\nfits within the message length:\n\n iphlen = iph->ihl * 4;\n err = -EINVAL;\n if (iphlen > length)\n goto error_free;\n\n if (iphlen >= sizeof(*iph)) {\n /* fix up saddr, tot_len, id, csum, transport_header */\n }\n\nIt does not, however, reject ihl < 5. For such a packet the\n\"if (iphlen >= sizeof(*iph))\" branch is skipped, leaving the\ncrafted iphdr untouched, but the packet is still handed to\n__ip_local_out() and onward. Downstream consumers that read\niph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in\nparticular subtracts sizeof(struct iphdr) from top_iph->ihl * 4\nand passes the (signed-int-negative, then cast to size_t)\nresult to memcpy(), producing an OOB access of length close to\nSIZE_MAX and a host kernel panic.\n\nAn IPv4 header with ihl < 5 is malformed by definition (RFC 791:\n\"Internet Header Length is the length of the internet header in\n32 bit words ... Note that the minimum value for a correct header\nis 5.\"). The kernel should not be willing to inject such a\npacket into its own output path.\n\nReject \"iphlen < sizeof(*iph)\" alongside the existing\n\"iphlen > length\" check. This matches the principle that locally\nconstructed packets that re-enter the IP stack must pass the same\nbasic sanity tests that a foreign packet would be subjected to.\n\nOnce this lands, the \"if (iphlen >= sizeof(*iph))\" wrapper around\nthe fixup branch becomes redundant; left in place to keep the\npatch minimal and backport-friendly. A follow-up can unwrap it.\n\nNote that commit 86f4c90a1c5c (\"ipv4, ipv6: ensure raw socket\nmessage is big enough to hold an IP header\") ensures the message\nbuffer is large enough to hold an iphdr, but does not constrain\nthe self-reported iph->ihl.\n\nReachability: the malformed packet source is any caller with\nCAP_NET_RAW, including an unprivileged process in a user+net\nnamespace on a kernel with CONFIG_USER_NS=y. The reproduced AH\ncrash also requires a matching xfrm AH policy on the outgoing\nroute; a container granted CAP_NET_ADMIN can install that state\nand policy in its netns. Loopback bypasses xfrm_output, so the\ntrigger uses a real netdev.\n\nReproduced on UML + KASAN: kernel-mode fault at addr 0x0 with\nmemcpy_orig at the crash site. Same shape reproduces inside a\nrootless Docker container with --cap-add NET_ADMIN on a stock\ndistro kernel.",
"provider": "mitre"
},
"metrics": {
"cvssV2_0": {
"data": {},
"provider": null
},
"cvssV3_0": {
"data": {},
"provider": null
},
"cvssV3_1": {
"data": {
"score": 7.8,
"vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"provider": "mitre"
},
"cvssV4_0": {
"data": {},
"provider": null
},
"epss": {
"data": {
"score": 0.00185
},
"provider": "first"
},
"kev": {
"data": {},
"provider": null
},
"ssvc": {
"data": {},
"provider": null
},
"threat_severity": {
"data": "Moderate",
"provider": "redhat"
}
},
"references": {
"data": [
"https://git.kernel.org/stable/c/1065b9efa4126df559b03a849c139ecfae92cd25",
"https://git.kernel.org/stable/c/145e9afa5b905229b4788bb72c3255f5a5f77508",
"https://git.kernel.org/stable/c/3c5411fa4944ed99af3d9d1de750ea8169b6dac9",
"https://git.kernel.org/stable/c/5a564f737ec54d63e8ee221d3ff396d07586d464",
"https://git.kernel.org/stable/c/7725cd3b471740fd23d25ed1da722c671fb2a5d3",
"https://git.kernel.org/stable/c/915fab69823a14c170dbaa3b41978768e0fe62fc",
"https://git.kernel.org/stable/c/bbe0be67de296176e7243c76e3d9f02f6ae9ff0b",
"https://git.kernel.org/stable/c/bc20dbd48c26e743f7e0845020c11ed2ce8b15ee",
"https://lore.kernel.org/linux-cve-announce/2026071923-CVE-2026-64114-d584@gregkh/T",
"https://nvd.nist.gov/vuln/detail/CVE-2026-64114",
"https://www.cve.org/CVERecord?id=CVE-2026-64114"
],
"providers": [
"mitre",
"nvd",
"redhat"
]
},
"title": {
"data": "ipv4: raw: reject IP_HDRINCL packets with ihl < 5",
"provider": "mitre"
},
"updated": {
"data": "2026-08-12T15:50:21.120000+00:00",
"provider": "nvd"
},
"vendors": {
"data": [
"linux",
"linux$PRODUCT$linux_kernel"
],
"providers": [
"mitre",
"nvd",
"enrichment"
]
},
"weaknesses": {
"data": [
"CWE-125",
"CWE-805"
],
"providers": [
"nvd",
"redhat"
]
}
},
"redhat": {
"cpes": [],
"created": "2026-07-19T00:00:00+00:00",
"description": "In the Linux kernel, the following vulnerability has been resolved:\nipv4: raw: reject IP_HDRINCL packets with ihl < 5\nraw_send_hdrinc() validates that the caller-supplied IPv4 header\nfits within the message length:\niphlen = iph->ihl * 4;\nerr = -EINVAL;\nif (iphlen > length)\ngoto error_free;\nif (iphlen >= sizeof(*iph)) {\n/* fix up saddr, tot_len, id, csum, transport_header */\n}\nIt does not, however, reject ihl < 5. For such a packet the\n\"if (iphlen >= sizeof(*iph))\" branch is skipped, leaving the\ncrafted iphdr untouched, but the packet is still handed to\n__ip_local_out() and onward. Downstream consumers that read\niph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in\nparticular subtracts sizeof(struct iphdr) from top_iph->ihl * 4\nand passes the (signed-int-negative, then cast to size_t)\nresult to memcpy(), producing an OOB access of length close to\nSIZE_MAX and a host kernel panic.\nAn IPv4 header with ihl < 5 is malformed by definition (RFC 791:\n\"Internet Header Length is the length of the internet header in\n32 bit words ... Note that the minimum value for a correct header\nis 5.\"). The kernel should not be willing to inject such a\npacket into its own output path.\nReject \"iphlen < sizeof(*iph)\" alongside the existing\n\"iphlen > length\" check. This matches the principle that locally\nconstructed packets that re-enter the IP stack must pass the same\nbasic sanity tests that a foreign packet would be subjected to.\nOnce this lands, the \"if (iphlen >= sizeof(*iph))\" wrapper around\nthe fixup branch becomes redundant; left in place to keep the\npatch minimal and backport-friendly. A follow-up can unwrap it.\nNote that commit 86f4c90a1c5c (\"ipv4, ipv6: ensure raw socket\nmessage is big enough to hold an IP header\") ensures the message\nbuffer is large enough to hold an iphdr, but does not constrain\nthe self-reported iph->ihl.\nReachability: the malformed packet source is any caller with\nCAP_NET_RAW, including an unprivileged process in a user+net\nnamespace on a kernel with CONFIG_USER_NS=y. The reproduced AH\ncrash also requires a matching xfrm AH policy on the outgoing\nroute; a container granted CAP_NET_ADMIN can install that state\nand policy in its netns. Loopback bypasses xfrm_output, so the\ntrigger uses a real netdev.\nReproduced on UML + KASAN: kernel-mode fault at addr 0x0 with\nmemcpy_orig at the crash site. Same shape reproduces inside a\nrootless Docker container with --cap-add NET_ADMIN on a stock\ndistro kernel.",
"metrics": {
"cvssV2_0": {},
"cvssV3_0": {},
"cvssV3_1": {
"score": 7.0,
"vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H"
},
"threat_severity": "Moderate"
},
"redhat_repo_path": "2026/CVE-2026-64114.json",
"references": [
"https://lore.kernel.org/linux-cve-announce/2026071923-CVE-2026-64114-d584@gregkh/T",
"https://nvd.nist.gov/vuln/detail/CVE-2026-64114",
"https://www.cve.org/CVERecord?id=CVE-2026-64114"
],
"title": "kernel: ipv4: raw: reject IP_HDRINCL packets with ihl < 5",
"updated": "2026-07-19T00:00:00+00:00",
"vendors": [],
"weaknesses": [
"CWE-805"
]
}
}
Enrichment data
Aggregated bundle (all enrichments)