Executive brief
A vulnerability in the Linux kernel's RDMA (Remote Direct Memory Access) over TCP component could allow a malicious network peer to trigger an out-of-bounds memory read. By sending specially crafted network packets with inconsistent length fields, an attacker can cause the system to read large amounts of kernel memory. This could lead to the exposure of sensitive information or cause system instability.
Technical details
A vulnerability exists in the Soft-iWARP (siw) driver within the Linux kernel's RDMA subsystem. The function siw_get_hdr() fails to validate the peer-controlled mpa_len field against the expected header length (hdr_len) for a given opcode. This leads to a signed integer underflow in siw_tcp_rx_data() when calculating fpdu_part_rem. The resulting negative value is passed to siw_check_mem() and eventually to skb_copy_bits(), where it is promoted to a large size_t value, triggering a multi-gigabyte out-of-bounds read. An attacker with a connected siw session can exploit this to leak kernel memory. The fix introduces a check to ensure mpa_len plus MPA_HDR_SIZE is not less than the required header length.
Affected products
- Linux Linux Kernel All versions prior to the July 2026 patches
Timeline
- 2026-05-13: disclosed: Initial patch submission by Michael Bommarito
- 2026-07-19: advisory: CVE-2026-64102 published
References
- https://git.kernel.org/stable/c/0ce1bc9e46ecabe84772bb561e373c0d9876d6f2
- https://git.kernel.org/stable/c/1012896f4225e8f801ff3c1648023845b66dfb11
- https://git.kernel.org/stable/c/14553be882d9ce91749c9d64041de66e34ad8e70
- https://git.kernel.org/stable/c/33a8b5e971e294ec2a7b74211c545e09efd8e9ac
- https://git.kernel.org/stable/c/4a331582011d9e8089af8aa2a61ec6b4443bb245
- https://git.kernel.org/stable/c/683f7cfbf514193d63c0efa079f3352bde84c2e0
- https://git.kernel.org/stable/c/775b4dc9618a99a1fa48b57554041a5dc17e1336