{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64009","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.026Z","datePublished":"2026-07-19T14:56:24.448Z","dateUpdated":"2026-08-05T12:38:09.114Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T12:38:09.114Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Check for underflow in xfrm_state_mtu\n\nLeo Lin reported OOB write issue in esp component:\n\n  xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\n  modulo-2^32 space using an attacker-influenced \"header_len + authsize +\n  net_adj\" subtracted from a small \"mtu\" argument. A nobody user can\n  install an IPv4 ESP tunnel SA with a large authentication key\n  (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\n  configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\n  large value. When a single UDP datagram is then sent through the\n  tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\n  esp_output() consumes it as a signed int via:\n\n        padto      = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached))\n        esp.tfclen = padto - skb->len   (assigned to int)\n\n  esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\n  when passed to memset() inside esp_output_fill_trailer(), producing a\n  ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n  \"Write of size 18446744073709551537 at addr ffff888...\".\n\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is triggered on the local ESP output path when a process sends a UDP datagram through an attacker-configured XFRM tunnel via sendmsg(); remote peers cannot install XFRM SAs, set interface MTU, or control XFRMA_TFCPAD on the victim system.\nAC:L - The attacker fully controls all preconditions (ESP tunnel SA with large HMAC-SHA512 auth, MTU 68, XFRMA_TFCPAD, and UDP payload size) and can trigger the underflow deterministically with a single datagram as demonstrated in the fix commit.\nPR:L - XFRM state/policy installation and interface MTU configuration require CAP_NET_ADMIN, which an unprivileged local user can obtain in a user namespace via unshare -Urn; this is the most severe reasonable deployment scenario on multi-tenant hosts.\nUI:N - Exploitation requires only the attacker's own netlink configuration and socket send operations; no action from another user or administrator is needed.\nS:U - The vulnerability corrupts kernel heap memory from a local attacker's security context, constituting standard kernel privilege escalation rather than crossing a VM or hypervisor boundary.\nC:H - The bug produces a massive out-of-bounds write via memset() at the skb tail pointer; such heap corruption is exploitable for arbitrary kernel memory disclosure in addition to the demonstrated KASAN-detected write primitive.\nI:H - A negative tfclen sign-extended to size_t causes an enormous memset() OOB write at skb_tail_pointer(skb), providing a memory corruption primitive that can be leveraged for arbitrary kernel writes and code execution.\nA:H - The OOB write reliably triggers kernel oops/panic (KASAN reports a write of size 18446744073709551537 bytes), causing immediate system crash and denial of service."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/xfrm/xfrm_state.c"],"versions":[{"version":"c5c2523893747f88a83376abad310c8ad13f7197","lessThan":"8014f70c4e6e5ab101ae3860a614e65e988372e3","status":"affected","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","lessThan":"1021d2877b689a648b27815c854557a917122e93","status":"affected","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","lessThan":"2a41b1b31c61c52b972278ce1732a1443f5e89ed","status":"affected","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","lessThan":"fccd685b32df5aaf6bad4381eeda216468e283f0","status":"affected","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","lessThan":"820e501be8aee4b365d218d83227b314309c5fda","status":"affected","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","lessThan":"82ac903e0b519849647657b8c48d21237ada06a2","status":"affected","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","lessThan":"3db50ceeacb52806d8fe86fb1dfe944df0b9f789","status":"affected","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","lessThan":"742b04d0550b0ec89dcbc99537ec88653bd1ad90","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/xfrm/xfrm_state.c"],"versions":[{"version":"2.6.22","status":"affected"},{"version":"0","lessThan":"2.6.22","status":"unaffected","versionType":"semver"},{"version":"5.10.259","lessThanOrEqual":"5.10.*","status":"unaffected","versionType":"semver"},{"version":"5.15.210","lessThanOrEqual":"5.15.*","status":"unaffected","versionType":"semver"},{"version":"6.1.176","lessThanOrEqual":"6.1.*","status":"unaffected","versionType":"semver"},{"version":"6.6.143","lessThanOrEqual":"6.6.*","status":"unaffected","versionType":"semver"},{"version":"6.12.93","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.35","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.12","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"5.10.259"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"7.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3"},{"url":"https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93"},{"url":"https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed"},{"url":"https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0"},{"url":"https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda"},{"url":"https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2"},{"url":"https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789"},{"url":"https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90"}],"title":"xfrm: Check for underflow in xfrm_state_mtu","x_generator":{"engine":"bippy-1.2.0"}}}}