CVE-2026-64102

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the RDMA Soft-iWARP (siw) component where the system fails to validate the MPA length field (c hdr->mpa len) of an incoming iWARP FPDU against the required header length for the announced opcode. A malicious peer can send a crafted FPDU with an MPA length smaller than the fixed DDP/RDMAP header, causing an integer underflow when calculating the remaining FPDU part (srx->fpdu part rem). This negative value is subsequently passed through siw proc write() or siw proc rresp() to siw check mem() and eventually to skb copy bits(). Because the signed length is promoted to size t during the copy process, it results in a multi-gigabyte out-of-bounds read, leading to a use-after-free condition.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.