CVE-2026-64114

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the IPv4 raw socket implementation where the raw send hdrinc() function fails to reject packets with an Internet Header Length (ihl) value of less than 5. According to RFC 791, the minimum value for a correct header is 5. When a crafted packet with ihl < 5 is processed, it bypasses certain validation checks and is passed to ip local out(). Downstream components, specifically the ah output() function in net/ipv4/ah4.c, assume the ihl value is sane and perform a subtraction that results in a negative signed integer. When this value is cast to size t and passed to memcpy(), it causes an out-of-bounds access with a length close to SIZE MAX, leading to a host kernel panic. This can be triggered by any caller with CAP NET RAW privileges, including unprivileged processes in a user namespace if CONFIG USER NS=y is enabled, provided there is a matching xfrm AH policy on the outgoing route.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.