PT-2026-61326 · Linux · Linux Kernel

CVE-2026-64009 · Published 2026-07-19 · Updated 2026-07-20

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An out-of-bounds write issue exists in the ESP component of the xfrm subsystem. The xfrm state mtu() function performs arithmetic in unsigned modulo-2^32 space, subtracting an attacker-influenced value consisting of header len, authsize, and net adj from a small mtu argument. This can lead to an underflow, resulting in a value near 2^32. When esp output() processes this value as a signed integer, the esp.tfclen variable can become negative. This negative value is then sign-extended to size t when passed to the memset() function within esp output fill trailer(), causing a massive write of zeroes at the skb tail pointer(skb) location.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2026-64009

Affected Products

Linux Kernel

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2026-64009 · Security Note
• https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93 · Note
• https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2 · Note
• https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed · Note
• https://twitter.com/danilofalcao/status/2079006500710719625 · Twitter Post
• https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90 · Note
• https://twitter.com/CVEnew/status/2078861423493382599 · Twitter Post
• https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0 · Note
• https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda · Note
• https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789 · Note
• https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3 · Note