CVE-2026-64009

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64009", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T07:54:57.026Z", "datePublished": "2026-07-19T14:56:24.448Z", "dateUpdated": "2026-10-19T20:28:08.230Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:38:09.114Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Check for underflow in xfrm_state_mtu\n\nLeo Lin reported OOB write issue in esp component:\n\n xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\n modulo-2^32 space using an attacker-influenced \"header_len + authsize +\n net_adj\" subtracted from a small \"mtu\" argument. A nobody user can\n install an IPv4 ESP tunnel SA with a large authentication key\n (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\n configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\n large value. When a single UDP datagram is then sent through the\n tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\n esp_output() consumes it as a signed int via:\n\n padto = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached))\n esp.tfclen = padto - skb->len (assigned to int)\n\n esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\n when passed to memset() inside esp_output_fill_trailer(), producing a\n ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n \"Write of size 18446744073709551537 at addr ffff888...\".\n\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered on the local ESP output path when a process sends a UDP datagram through an attacker-configured XFRM tunnel via sendmsg(); remote peers cannot install XFRM SAs, set interface MTU, or control XFRMA_TFCPAD on the victim system.\nAC:L - The attacker fully controls all preconditions (ESP tunnel SA with large HMAC-SHA512 auth, MTU 68, XFRMA_TFCPAD, and UDP payload size) and can trigger the underflow deterministically with a single datagram as demonstrated in the fix commit.\nPR:L - XFRM state/policy installation and interface MTU configuration require CAP_NET_ADMIN, which an unprivileged local user can obtain in a user namespace via unshare -Urn; this is the most severe reasonable deployment scenario on multi-tenant hosts.\nUI:N - Exploitation requires only the attacker's own netlink configuration and socket send operations; no action from another user or administrator is needed.\nS:U - The vulnerability corrupts kernel heap memory from a local attacker's security context, constituting standard kernel privilege escalation rather than crossing a VM or hypervisor boundary.\nC:H - The bug produces a massive out-of-bounds write via memset() at the skb tail pointer; such heap corruption is exploitable for arbitrary kernel memory disclosure in addition to the demonstrated KASAN-detected write primitive.\nI:H - A negative tfclen sign-extended to size_t causes an enormous memset() OOB write at skb_tail_pointer(skb), providing a memory corruption primitive that can be leveraged for arbitrary kernel writes and code execution.\nA:H - The OOB write reliably triggers kernel oops/panic (KASAN reports a write of size 18446744073709551537 bytes), causing immediate system crash and denial of service."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/xfrm/xfrm_state.c"], "versions": [{"version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "8014f70c4e6e5ab101ae3860a614e65e988372e3", "status": "affected", "versionType": "git"}, {"version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "1021d2877b689a648b27815c854557a917122e93", "status": "affected", "versionType": "git"}, {"version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "2a41b1b31c61c52b972278ce1732a1443f5e89ed", "status": "affected", "versionType": "git"}, {"version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "fccd685b32df5aaf6bad4381eeda216468e283f0", "status": "affected", "versionType": "git"}, {"version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "820e501be8aee4b365d218d83227b314309c5fda", "status": "affected", "versionType": "git"}, {"version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "82ac903e0b519849647657b8c48d21237ada06a2", "status": "affected", "versionType": "git"}, {"version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "3db50ceeacb52806d8fe86fb1dfe944df0b9f789", "status": "affected", "versionType": "git"}, {"version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "742b04d0550b0ec89dcbc99537ec88653bd1ad90", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["net/xfrm/xfrm_state.c"], "versions": [{"version": "2.6.22", "status": "affected"}, {"version": "0", "lessThan": "2.6.22", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.259", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "5.10.259"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.22", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3"}, {"url": "https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93"}, {"url": "https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed"}, {"url": "https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0"}, {"url": "https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda"}, {"url": "https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2"}, {"url": "https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789"}, {"url": "https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90"}], "title": "xfrm: Check for underflow in xfrm_state_mtu", "x_generator": {"engine": "bippy-1.2.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64009", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:35:15.345325Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-191", "description": "CWE-191 Integer Underflow (Wrap or Wraparound)"}]}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-19T20:28:08.230Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-64009", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-10-16T15:35:15.345325Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-16T15:35:15.906Z"}}], "cna": {"title": "xfrm: Check for underflow in xfrm_state_mtu", "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 7.8, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H"}, "scenarios": [{"lang": "en", "value": "AV:L - The vulnerability is triggered on the local ESP output path when a process sends a UDP datagram through an attacker-configured XFRM tunnel via sendmsg(); remote peers cannot install XFRM SAs, set interface MTU, or control XFRMA_TFCPAD on the victim system.\nAC:L - The attacker fully controls all preconditions (ESP tunnel SA with large HMAC-SHA512 auth, MTU 68, XFRMA_TFCPAD, and UDP payload size) and can trigger the underflow deterministically with a single datagram as demonstrated in the fix commit.\nPR:L - XFRM state/policy installation and interface MTU configuration require CAP_NET_ADMIN, which an unprivileged local user can obtain in a user namespace via unshare -Urn; this is the most severe reasonable deployment scenario on multi-tenant hosts.\nUI:N - Exploitation requires only the attacker's own netlink configuration and socket send operations; no action from another user or administrator is needed.\nS:U - The vulnerability corrupts kernel heap memory from a local attacker's security context, constituting standard kernel privilege escalation rather than crossing a VM or hypervisor boundary.\nC:H - The bug produces a massive out-of-bounds write via memset() at the skb tail pointer; such heap corruption is exploitable for arbitrary kernel memory disclosure in addition to the demonstrated KASAN-detected write primitive.\nI:H - A negative tfclen sign-extended to size_t causes an enormous memset() OOB write at skb_tail_pointer(skb), providing a memory corruption primitive that can be leveraged for arbitrary kernel writes and code execution.\nA:H - The OOB write reliably triggers kernel oops/panic (KASAN reports a write of size 18446744073709551537 bytes), causing immediate system crash and denial of service."}]}], "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "8014f70c4e6e5ab101ae3860a614e65e988372e3", "versionType": "git"}, {"status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "1021d2877b689a648b27815c854557a917122e93", "versionType": "git"}, {"status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "2a41b1b31c61c52b972278ce1732a1443f5e89ed", "versionType": "git"}, {"status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "fccd685b32df5aaf6bad4381eeda216468e283f0", "versionType": "git"}, {"status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "820e501be8aee4b365d218d83227b314309c5fda", "versionType": "git"}, {"status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "82ac903e0b519849647657b8c48d21237ada06a2", "versionType": "git"}, {"status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "3db50ceeacb52806d8fe86fb1dfe944df0b9f789", "versionType": "git"}, {"status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "lessThan": "742b04d0550b0ec89dcbc99537ec88653bd1ad90", "versionType": "git"}], "programFiles": ["net/xfrm/xfrm_state.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "2.6.22"}, {"status": "unaffected", "version": "0", "lessThan": "2.6.22", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.259", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.210", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.176", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.143", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.93", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.35", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.0.12", "versionType": "semver", "lessThanOrEqual": "7.0.*"}, {"status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["net/xfrm/xfrm_state.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3"}, {"url": "https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93"}, {"url": "https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed"}, {"url": "https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0"}, {"url": "https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda"}, {"url": "https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2"}, {"url": "https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789"}, {"url": "https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90"}], "x_generator": {"engine": "bippy-1.2.0"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Check for underflow in xfrm_state_mtu\n\nLeo Lin reported OOB write issue in esp component:\n\n xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\n modulo-2^32 space using an attacker-influenced \"header_len + authsize +\n net_adj\" subtracted from a small \"mtu\" argument. A nobody user can\n install an IPv4 ESP tunnel SA with a large authentication key\n (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\n configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\n large value. When a single UDP datagram is then sent through the\n tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\n esp_output() consumes it as a signed int via:\n\n padto = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached))\n esp.tfclen = padto - skb->len (assigned to int)\n\n esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\n when passed to memset() inside esp_output_fill_trailer(), producing a\n ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n \"Write of size 18446744073709551537 at addr ffff888...\".\n\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH."}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.10.259", "versionStartIncluding": "2.6.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "5.15.210", "versionStartIncluding": "2.6.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.1.176", "versionStartIncluding": "2.6.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.6.143", "versionStartIncluding": "2.6.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.12.93", "versionStartIncluding": "2.6.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "6.18.35", "versionStartIncluding": "2.6.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.0.12", "versionStartIncluding": "2.6.22"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "7.1", "versionStartIncluding": "2.6.22"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T12:38:09.114Z"}}}, "cveMetadata": {"cveId": "CVE-2026-64009", "state": "PUBLISHED", "dateUpdated": "2026-10-16T15:42:18.442Z", "dateReserved": "2026-07-19T07:54:57.026Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2026-07-19T14:56:24.448Z", "assignerShortName": "Linux"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["net/xfrm/xfrm_state.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "8014f70c4e6e5ab101ae3860a614e65e988372e3", "status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "versionType": "git"}, {"lessThan": "1021d2877b689a648b27815c854557a917122e93", "status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "versionType": "git"}, {"lessThan": "2a41b1b31c61c52b972278ce1732a1443f5e89ed", "status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "versionType": "git"}, {"lessThan": "fccd685b32df5aaf6bad4381eeda216468e283f0", "status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "versionType": "git"}, {"lessThan": "820e501be8aee4b365d218d83227b314309c5fda", "status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "versionType": "git"}, {"lessThan": "82ac903e0b519849647657b8c48d21237ada06a2", "status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "versionType": "git"}, {"lessThan": "3db50ceeacb52806d8fe86fb1dfe944df0b9f789", "status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "versionType": "git"}, {"lessThan": "742b04d0550b0ec89dcbc99537ec88653bd1ad90", "status": "affected", "version": "c5c2523893747f88a83376abad310c8ad13f7197", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["net/xfrm/xfrm_state.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "2.6.22"}, {"lessThan": "2.6.22", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.259", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.93", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "D88CE404-F14A-49F7-862B-23D7205FD4C4", "versionEndExcluding": "5.10.259", "versionStartIncluding": "2.6.22", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801", "versionEndExcluding": "5.15.210", "versionStartIncluding": "5.11", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757", "versionEndExcluding": "6.1.176", "versionStartIncluding": "5.16", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C", "versionEndExcluding": "6.6.143", "versionStartIncluding": "6.2", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63", "versionEndExcluding": "6.12.93", "versionStartIncluding": "6.7", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382", "versionEndExcluding": "6.18.35", "versionStartIncluding": "6.13", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3", "versionEndExcluding": "7.0.12", "versionStartIncluding": "6.19", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*", "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9", "vulnerable": true}, {"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*", "matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Check for underflow in xfrm_state_mtu\n\nLeo Lin reported OOB write issue in esp component:\n\n xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\n modulo-2^32 space using an attacker-influenced \"header_len + authsize +\n net_adj\" subtracted from a small \"mtu\" argument. A nobody user can\n install an IPv4 ESP tunnel SA with a large authentication key\n (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\n configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\n large value. When a single UDP datagram is then sent through the\n tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\n esp_output() consumes it as a signed int via:\n\n padto = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached))\n esp.tfclen = padto - skb->len (assigned to int)\n\n esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\n when passed to memset() inside esp_output_fill_trailer(), producing a\n ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n \"Write of size 18446744073709551537 at addr ffff888...\".\n\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH."}], "id": "CVE-2026-64009", "lastModified": "2026-10-19T21:17:18.950", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-64009", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-10-16T15:35:15.345325Z", "version": "2.0.3"}}]}, "published": "2026-07-19T16:17:40.663", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "tags": ["Patch"], "url": "https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-787"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-191"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{"bugzilla": {"description": "kernel: xfrm: Check for underflow in xfrm_state_mtu", "id": "2502403", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2502403"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nxfrm: Check for underflow in xfrm_state_mtu\nLeo Lin reported OOB write issue in esp component:\nxfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\nmodulo-2^32 space using an attacker-influenced \"header_len + authsize +\nnet_adj\" subtracted from a small \"mtu\" argument. A nobody user can\ninstall an IPv4 ESP tunnel SA with a large authentication key\n(XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\nconfigure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\nlarge value. When a single UDP datagram is then sent through the\ntunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\nesp_output() consumes it as a signed int via:\npadto = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached))\nesp.tfclen = padto - skb->len (assigned to int)\nesp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\nwhen passed to memset() inside esp_output_fill_trailer(), producing a\n~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n\"Write of size 18446744073709551537 at addr ffff888...\".\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH.", "A flaw was found in the Linux kernel's xfrm (IPSec framework) component. A local, unprivileged user can trigger an integer underflow in the Encapsulating Security Payload (ESP) module's Maximum Transmission Unit (MTU) calculation. This underflow leads to a severe out-of-bounds write, which can cause memory corruption. The primary impact of this vulnerability is a denial of service, with potential for further system compromise."], "name": "CVE-2026-64009", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:hummingbird:1", "fix_state": "Not affected", "impact": "moderate", "package_name": "erlang27", "product_name": "Red Hat Hardened Images"}], "public_date": "2026-07-19T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64009\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64009\nhttps://lore.kernel.org/linux-cve-announce/2026071908-CVE-2026-64009-4587@gregkh/T"], "threat_severity": "Important"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5c2523893747f88a83376abad310c8ad13f7197,8014f70c4e6e5ab101ae3860a614e65e988372e3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5c2523893747f88a83376abad310c8ad13f7197,1021d2877b689a648b27815c854557a917122e93)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5c2523893747f88a83376abad310c8ad13f7197,2a41b1b31c61c52b972278ce1732a1443f5e89ed)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5c2523893747f88a83376abad310c8ad13f7197,3db50ceeacb52806d8fe86fb1dfe944df0b9f789)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5c2523893747f88a83376abad310c8ad13f7197,742b04d0550b0ec89dcbc99537ec88653bd1ad90)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5c2523893747f88a83376abad310c8ad13f7197,8014f70c4e6e5ab101ae3860a614e65e988372e3)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5c2523893747f88a83376abad310c8ad13f7197,820e501be8aee4b365d218d83227b314309c5fda)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5c2523893747f88a83376abad310c8ad13f7197,82ac903e0b519849647657b8c48d21237ada06a2)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[c5c2523893747f88a83376abad310c8ad13f7197,fccd685b32df5aaf6bad4381eeda216468e283f0)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "2.6.22"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,2.6.22)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.10.259,5.10.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[5.15.210,5.15.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.1.176,6.1.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.6.143,6.6.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[6.12.93,6.12.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.0.12,7.0.*]"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-21T07:30:03.261476+00:00", "updated": "2026-10-20T14:00:16.578479+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}