PT-2026-64635 · Linux · Linux
CVE-2026-64414
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
netfilter: handle unreadable frags
sashiko reports:
When an skb with unreadable fragments (such as from devmem TCP, where
skb frags readable(skb) returns false) is processed by the u32 module,
skb copy bits() will safely return a negative error code [..]
xt u32: bail out with hotdrop in this case.
gather frags: return -1, just as if we had no fragment header.
nfnetlink queue: restrict to the linear part.
nfnetlink log: restrict to the linear part.
v2:
- skb zerocopy helpers don't copy readable flag, i.e. nfnetlink queue is broken too xt u32 shouldn't return true if hotdrop was set.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux