Vulnerability-Lookup

CVE-2026-64268 (GCVE-0-2026-64268)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-07-27 04:59

Title

RDMA/siw: bound Read Response placement to the RREAD length

Summary

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accumulates wqe->processed, but it never checks the running total against the sink buffer length on continuation segments. siw_check_sge() resolves and validates the sink memory only on the first fragment (the if (!*mem) branch), and siw_rresp_check_ntoh() compares the cumulative length against wqe->bytes only on the final segment (the !frx->more_ddp_segs guard). A connected siw peer that answers an outstanding RREAD with Read Response segments that keep the DDP Last flag clear, carrying more total payload than the RREAD requested, drives wqe->processed past the validated sink buffer; the next siw_rx_data() call writes out of bounds at sge->laddr + wqe->processed. siw runs iWARP over ordinary routable TCP, so the peer is the remote end of an established RDMA connection and needs no local privilege. Bound every segment before placement, exactly as siw_proc_send() and siw_proc_write() already do for their tagged and untagged paths, and terminate the connection with a base-or-bounds DDP error when the Read Response would overrun the sink buffer. This is the second receive-path length fix for this file. A separate change rejects an MPA FPDU length that underflows the per-fragment remainder in the header decode; that guard does not cover this case, because here each individual segment length is self-consistent and only the accumulated placement offset overruns the buffer.

Severity

9.8 (Critical)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Assigner

Linux

References

8 references

URL	Tags
https://git.kernel.org/stable/c/a31b6d18ded3cc32d…
https://git.kernel.org/stable/c/595e6537ad1a210da…
https://git.kernel.org/stable/c/3ef7e052cbd05a8b1…
https://git.kernel.org/stable/c/b2e26c955f8dd7e8d…
https://git.kernel.org/stable/c/6bc89f34a4597f9f6…
https://git.kernel.org/stable/c/423a78ff7928c2601…
https://git.kernel.org/stable/c/75c93cd3c421890f4…
https://git.kernel.org/stable/c/7d29f7e9dbd844cae…

Impacted products

2 products

Vendor	Product	Version
Linux	Linux	Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < a31b6d18ded3cc32d9ee85a6ff0726d4274887b2 (git) Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < 595e6537ad1a210da32cbb9a7f91aa73090915ba (git) Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < 3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf (git) Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < b2e26c955f8dd7e8d3f16c858db05245ea4fa817 (git) Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < 6bc89f34a4597f9f6d41f7a60c67a3153bfe8851 (git) Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < 423a78ff7928c2601013f73ec6d896f5597d0df5 (git) Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < 75c93cd3c421890f49ea93f0b978b9b7bb10e5e3 (git) Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < 7d29f7e9dbd844cae4d3e559cf78324b9642fd6b (git)
Linux	Linux	Affected: 5.3 Unaffected: 0 , < 5.3 (semver) Unaffected: 5.10.261 , ≤ 5.10.* (semver) Unaffected: 5.15.212 , ≤ 5.15.* (semver) Unaffected: 6.1.178 , ≤ 6.1.* (semver) Unaffected: 6.6.145 , ≤ 6.6.* (semver) Unaffected: 6.12.96 , ≤ 6.12.* (semver) Unaffected: 6.18.39 , ≤ 6.18.* (semver) Unaffected: 7.1.4 , ≤ 7.1.* (semver) Unaffected: 7.2-rc1 , ≤ * (original_commit_for_fix)

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_qp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a31b6d18ded3cc32d9ee85a6ff0726d4274887b2",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "595e6537ad1a210da32cbb9a7f91aa73090915ba",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "b2e26c955f8dd7e8d3f16c858db05245ea4fa817",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "6bc89f34a4597f9f6d41f7a60c67a3153bfe8851",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "423a78ff7928c2601013f73ec6d896f5597d0df5",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "75c93cd3c421890f49ea93f0b978b9b7bb10e5e3",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "7d29f7e9dbd844cae4d3e559cf78324b9642fd6b",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_qp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2-rc1",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: bound Read Response placement to the RREAD length\n\nIn drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each\ninbound Read Response DDP segment at sge-\u003eladdr + wqe-\u003eprocessed and then\naccumulates wqe-\u003eprocessed, but it never checks the running total against\nthe sink buffer length on continuation segments. siw_check_sge() resolves\nand validates the sink memory only on the first fragment (the if (!*mem)\nbranch), and siw_rresp_check_ntoh() compares the cumulative length against\nwqe-\u003ebytes only on the final segment (the !frx-\u003emore_ddp_segs guard).\n\nA connected siw peer that answers an outstanding RREAD with Read Response\nsegments that keep the DDP Last flag clear, carrying more total payload\nthan the RREAD requested, drives wqe-\u003eprocessed past the validated sink\nbuffer; the next siw_rx_data() call writes out of bounds at\nsge-\u003eladdr + wqe-\u003eprocessed. siw runs iWARP over ordinary routable TCP,\nso the peer is the remote end of an established RDMA connection and needs\nno local privilege.\n\nBound every segment before placement, exactly as siw_proc_send() and\nsiw_proc_write() already do for their tagged and untagged paths, and\nterminate the connection with a base-or-bounds DDP error when the\nRead Response would overrun the sink buffer.\n\nThis is the second receive-path length fix for this file. A separate\nchange rejects an MPA FPDU length that underflows the per-fragment\nremainder in the header decode; that guard does not cover this case,\nbecause here each individual segment length is self-consistent and only\nthe accumulated placement offset overruns the buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-07-27T04:59:18.262Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a31b6d18ded3cc32d9ee85a6ff0726d4274887b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/595e6537ad1a210da32cbb9a7f91aa73090915ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2e26c955f8dd7e8d3f16c858db05245ea4fa817"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bc89f34a4597f9f6d41f7a60c67a3153bfe8851"
        },
        {
          "url": "https://git.kernel.org/stable/c/423a78ff7928c2601013f73ec6d896f5597d0df5"
        },
        {
          "url": "https://git.kernel.org/stable/c/75c93cd3c421890f49ea93f0b978b9b7bb10e5e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b"
        }
      ],
      "title": "RDMA/siw: bound Read Response placement to the RREAD length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64268",
    "datePublished": "2026-07-25T08:49:16.336Z",
    "dateReserved": "2026-07-19T15:36:31.775Z",
    "dateUpdated": "2026-07-27T04:59:18.262Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64268",
      "date": "2026-07-26",
      "epss": "0.00211",
      "percentile": "0.11446"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-26T01:07:33.000Z",
      "cve": "CVE-2026-64268",
      "id": "msrc_CVE-2026-64268",
      "initial_release_date": "2026-07-26T01:07:33.000Z",
      "product_status:under_investigation": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/siw: bound Read Response placement to the RREAD length",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64268.json",
      "version": "1"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64268\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:07.013\",\"lastModified\":\"2026-07-27T05:16:38.680\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/siw: bound Read Response placement to the RREAD length\\n\\nIn drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each\\ninbound Read Response DDP segment at sge-\u003eladdr + wqe-\u003eprocessed and then\\naccumulates wqe-\u003eprocessed, but it never checks the running total against\\nthe sink buffer length on continuation segments. siw_check_sge() resolves\\nand validates the sink memory only on the first fragment (the if (!*mem)\\nbranch), and siw_rresp_check_ntoh() compares the cumulative length against\\nwqe-\u003ebytes only on the final segment (the !frx-\u003emore_ddp_segs guard).\\n\\nA connected siw peer that answers an outstanding RREAD with Read Response\\nsegments that keep the DDP Last flag clear, carrying more total payload\\nthan the RREAD requested, drives wqe-\u003eprocessed past the validated sink\\nbuffer; the next siw_rx_data() call writes out of bounds at\\nsge-\u003eladdr + wqe-\u003eprocessed. siw runs iWARP over ordinary routable TCP,\\nso the peer is the remote end of an established RDMA connection and needs\\nno local privilege.\\n\\nBound every segment before placement, exactly as siw_proc_send() and\\nsiw_proc_write() already do for their tagged and untagged paths, and\\nterminate the connection with a base-or-bounds DDP error when the\\nRead Response would overrun the sink buffer.\\n\\nThis is the second receive-path length fix for this file. A separate\\nchange rejects an MPA FPDU length that underflows the per-fragment\\nremainder in the header decode; that guard does not cover this case,\\nbecause here each individual segment length is self-consistent and only\\nthe accumulated placement offset overruns the buffer.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/sw/siw/siw_qp_rx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"a31b6d18ded3cc32d9ee85a6ff0726d4274887b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"595e6537ad1a210da32cbb9a7f91aa73090915ba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"b2e26c955f8dd7e8d3f16c858db05245ea4fa817\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"6bc89f34a4597f9f6d41f7a60c67a3153bfe8851\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"423a78ff7928c2601013f73ec6d896f5597d0df5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"75c93cd3c421890f49ea93f0b978b9b7bb10e5e3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"7d29f7e9dbd844cae4d3e559cf78324b9642fd6b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/sw/siw/siw_qp_rx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2-rc1\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/423a78ff7928c2601013f73ec6d896f5597d0df5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/595e6537ad1a210da32cbb9a7f91aa73090915ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/6bc89f34a4597f9f6d41f7a60c67a3153bfe8851\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/75c93cd3c421890f49ea93f0b978b9b7bb10e5e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/a31b6d18ded3cc32d9ee85a6ff0726d4274887b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"},{\"url\":\"https://git.kernel.org/stable/c/b2e26c955f8dd7e8d3f16c858db05245ea4fa817\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\"}]}}",
    "suse_vex": {
      "aggregate_severity": "not set",
      "current_release_date": "2026-07-25T16:46:57Z",
      "cve": "CVE-2026-64268",
      "id": "CVE-2026-64268",
      "initial_release_date": "2026-07-25T16:46:57Z",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64268",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64268.json",
      "version": "2"
    }
  }
}

GHSA-86RP-M36J-7R28

Vulnerability from github – Published: 2026-07-25 12:31 – Updated: 2026-07-27 06:30

Details

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: bound Read Response placement to the RREAD length

In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accumulates wqe->processed, but it never checks the running total against the sink buffer length on continuation segments. siw_check_sge() resolves and validates the sink memory only on the first fragment (the if (!*mem) branch), and siw_rresp_check_ntoh() compares the cumulative length against wqe->bytes only on the final segment (the !frx->more_ddp_segs guard).

A connected siw peer that answers an outstanding RREAD with Read Response segments that keep the DDP Last flag clear, carrying more total payload than the RREAD requested, drives wqe->processed past the validated sink buffer; the next siw_rx_data() call writes out of bounds at sge->laddr + wqe->processed. siw runs iWARP over ordinary routable TCP, so the peer is the remote end of an established RDMA connection and needs no local privilege.

Bound every segment before placement, exactly as siw_proc_send() and siw_proc_write() already do for their tagged and untagged paths, and terminate the connection with a base-or-bounds DDP error when the Read Response would overrun the sink buffer.

This is the second receive-path length fix for this file. A separate change rejects an MPA FPDU length that underflows the per-fragment remainder in the header decode; that guard does not cover this case, because here each individual segment length is self-consistent and only the accumulated placement offset overruns the buffer.

Severity

9.8 (Critical)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-64268"
  ],
  "database_specific": {
    "cwe_ids": [],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-07-25T10:17:07Z",
    "severity": "CRITICAL"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: bound Read Response placement to the RREAD length\n\nIn drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each\ninbound Read Response DDP segment at sge-\u003eladdr + wqe-\u003eprocessed and then\naccumulates wqe-\u003eprocessed, but it never checks the running total against\nthe sink buffer length on continuation segments. siw_check_sge() resolves\nand validates the sink memory only on the first fragment (the if (!*mem)\nbranch), and siw_rresp_check_ntoh() compares the cumulative length against\nwqe-\u003ebytes only on the final segment (the !frx-\u003emore_ddp_segs guard).\n\nA connected siw peer that answers an outstanding RREAD with Read Response\nsegments that keep the DDP Last flag clear, carrying more total payload\nthan the RREAD requested, drives wqe-\u003eprocessed past the validated sink\nbuffer; the next siw_rx_data() call writes out of bounds at\nsge-\u003eladdr + wqe-\u003eprocessed. siw runs iWARP over ordinary routable TCP,\nso the peer is the remote end of an established RDMA connection and needs\nno local privilege.\n\nBound every segment before placement, exactly as siw_proc_send() and\nsiw_proc_write() already do for their tagged and untagged paths, and\nterminate the connection with a base-or-bounds DDP error when the\nRead Response would overrun the sink buffer.\n\nThis is the second receive-path length fix for this file. A separate\nchange rejects an MPA FPDU length that underflows the per-fragment\nremainder in the header decode; that guard does not cover this case,\nbecause here each individual segment length is self-consistent and only\nthe accumulated placement offset overruns the buffer.",
  "id": "GHSA-86rp-m36j-7r28",
  "modified": "2026-07-27T06:30:31Z",
  "published": "2026-07-25T12:31:28Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64268"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/423a78ff7928c2601013f73ec6d896f5597d0df5"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/595e6537ad1a210da32cbb9a7f91aa73090915ba"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/6bc89f34a4597f9f6d41f7a60c67a3153bfe8851"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/75c93cd3c421890f49ea93f0b978b9b7bb10e5e3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/a31b6d18ded3cc32d9ee85a6ff0726d4274887b2"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/b2e26c955f8dd7e8d3f16c858db05245ea4fa817"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ]
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.

Action not permitted

CVE-2026-64268 (GCVE-0-2026-64268)

GHSA-86RP-M36J-7R28

Tags

Sightings

Nomenclature