PT-2026-61419 · Linux · Linux
CVE-2026-64102
·
Published
2026-07-19
·
Updated
2026-07-19
CVSS v3.1
9.8
Critical
| Vector | AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Reject MPA FPDU length underflow before signed receive math
A malicious connected siw peer can send an iWARP FPDU whose MPA length
field (c hdr->mpa len, 16 bit big-endian, peer-controlled) is smaller
than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP
parses the full header in siw get hdr() based on iwarp pktinfo[opcode]
.hdr len, but never compares mpa len against that header length.
siw tcp rx data() then derives
srx->fpdu part rem = be16 to cpu(mpa len) - fpdu part rcvd
+ MPA HDR SIZE;
where fpdu part rcvd equals iwarp pktinfo[opcode].hdr len at this
point. For a tagged WRITE (hdr len 16, MPA HDR SIZE 2) the smallest
on-wire mpa len of 0 yields fpdu part rem = -14, and any mpa len below
hdr len - MPA HDR SIZE underflows to a negative int.
The signed value then flows into siw proc write()/siw proc rresp() as
bytes = min(srx->fpdu part rem, srx->skb new);
is handed to siw check mem() as an int len (whose interval check
addr + len > mem->va + mem->len is satisfied for a valid base when
len is negative), and reaches siw rx data() -> siw rx kva() /
siw rx umem() -> skb copy bits() as a signed copy length. The header
copy branch in skb copy bits() promotes that to size t, producing a
multi-gigabyte read.
KASAN under a KUnit harness that drives the real kernel TCP receive
path -- a loopback AF INET socketpair, the malformed FPDU written via
kernel sendmsg, sk data ready firing in softirq, tcp read sock
dispatching to siw tcp rx data -- reports:
BUG: KASAN: use-after-free in skb copy bits+0x284/0x480
Read of size 4294967295 at addr ffff888...
Call Trace:
skb copy bits
siw rx kva
siw rx data
siw check mem
siw proc write
siw tcp rx data
tcp read sock
siw qp llp data ready
tcp data ready
tcp data queue
Add the missing invariant at the earliest point where the peer header
is fully assembled. iwarp pktinfo[*].hdr len - MPA HDR SIZE is exactly
the value the siw transmitter uses as the minimum mpa len for each
opcode (drivers/infiniband/sw/siw/siw qp.c:33), so this matches the
protocol contract. Out-of-range FPDUs terminate the connection with
TERM ERROR LAYER LLP / LLP ETYPE MPA / LLP ECODE FPDU START -- which
is RFC 5044 Section 8 error code 3 ("Marker and ULPDU Length fields
do not agree on the start of an FPDU"), the correct framing-error
class for this inconsistency.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux