CVE-2026-64268

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the RDMA siw driver where the siw proc rresp() function fails to check the running total of inbound Read Response DDP segments against the sink buffer length on continuation segments. While siw check sge() validates sink memory on the first fragment and siw rresp check ntoh() compares cumulative length on the final segment, intermediate segments are not bounded. A remote peer on an established RDMA connection can send Read Response segments that keep the DDP Last flag clear and carry more payload than requested, causing wqe->processed to exceed the validated sink buffer. This leads to an out-of-bounds write during the subsequent siw rx data() call. This flaw can be exploited by a remote peer over routable TCP without requiring local privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.