Riskcovery

CVE-2026-64414

netfilter: handle unreadable frags

State
Published
Severity
7.5 High
Published
Jul 25, 2026
Updated
Aug 17, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

netfilter: handle unreadable frags

sashiko reports: When an skb with unreadable fragments (such as from devmem TCP, where skb_frags_readable(skb) returns false) is processed by the u32 module, skb_copy_bits() will safely return a negative error code [..]

xt_u32: bail out with hotdrop in this case. gather_frags: return -1, just as if we had no fragment header. nfnetlink_queue: restrict to the linear part. nfnetlink_log: restrict to the linear part.

v2: - skb_zerocopy helpers don't copy readable flag, i.e. nfnetlink_queue is broken too xt_u32 shouldn't return true if hotdrop was set.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HLinux

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 65249feb6b3df9e17bab5911ee56fa7b0971e231 to before 3b13e7635795394705920cca1e1db7e4ca2e334bAffected
  • 65249feb6b3df9e17bab5911ee56fa7b0971e231 to before fc5bfe63bacf8a3ae307b62b34206406ca733354Affected
  • 65249feb6b3df9e17bab5911ee56fa7b0971e231 to before 57056be3ec12e7d9ecd20a60d4060f510e4f284cAffected
  • 65249feb6b3df9e17bab5911ee56fa7b0971e231 to before da5b58478a9c1b85608c9e40a3b8432d071b409eAffected
LinuxLinux
  • 6.12Affected
  • before 6.12Not affected
  • 6.12.96 through 6.12.*Not affected
  • 6.18.39 through 6.18.*Not affected
  • 7.1.4 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.