CVE-2026-64102 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: Reject MPA FPDU length underflow before signed receive math
A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode]
.hdr_len, but never compares mpa_len against that header length.
siw_tcp_rx_data() then derives
srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE;
where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this
point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int.
The signed value then flows into siw_proc_write()/siw_proc_rresp() as
bytes = min(srx->fpdu_part_rem, srx->skb_new);
is handed to siw_check_mem() as an int len (whose interval check addr + len > mem->va + mem->len is satisfied for a valid base when len is negative), and reaches siw_rx_data() -> siw_rx_kva() / siw_rx_umem() -> skb_copy_bits() as a signed copy length. The header copy branch in skb_copy_bits() promotes that to size_t, producing a multi-gigabyte read.
KASAN under a KUnit harness that drives the real kernel TCP receive path -- a loopback AF_INET socketpair, the malformed FPDU written via kernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock dispatching to siw_tcp_rx_data -- reports:
BUG: KASAN: use-after-free in skb_copy_bits+0x284/0x480 Read of size 4294967295 at addr ffff888... Call Trace: skb_copy_bits siw_rx_kva siw_rx_data siw_check_mem siw_proc_write siw_tcp_rx_data __tcp_read_sock siw_qp_llp_data_ready tcp_data_ready tcp_data_queue
Add the missing invariant at the earliest point where the peer header is fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly
the value the siw transmitter uses as the minimum mpa_len for each opcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the protocol contract. Out-of-range FPDUs terminate the connection with TERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which is RFC 5044 Section 8 error code 3 ("Marker and ULPDU Length fields do not agree on the start of an FPDU"), the correct framing-error class for this inconsistency.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability described represents a critical buffer over-read condition within the Linux kernel's soft-iWARP implementation, specifically affecting the RDMA/siw subsystem. This flaw arises from an insufficient validation of the MPA (Multiprotocol Aggregation) header length field in iWARP Fast Path Data Units, allowing a malicious peer to craft malformed FPDU packets that can trigger unexpected behavior in the kernel's receive processing path. The issue stems from a fundamental mismatch between the expected and actual header lengths, where the MPA length field is not properly validated against the minimum required header size for the announced opcode, creating a scenario where signed integer underflow occurs during packet processing.
The technical execution of this vulnerability begins with the parsing of incoming iWARP packets through the siw_get_hdr() function, which extracts and processes the fixed DDP/RDMAP headers based on predefined opcode mappings stored in iwarp_pktinfo structures. However, no validation occurs to ensure that the peer-controlled mpa_len field is sufficient to accommodate the complete header structure for the specified operation. When processing tagged WRITE operations with a header length of 16 bytes, where MPA_HDR_SIZE equals 2 bytes, an attacker can manipulate the mpa_len field to values below the minimum required threshold, causing arithmetic underflow that results in negative integer values being propagated through the receive pipeline.
The operational impact becomes evident when siw_tcp_rx_data() computes fpdu_part_rem using the underflowed mpa_len value, which then gets passed through multiple kernel functions including siw_proc_write() and siw_proc_rresp(), eventually reaching siw_check_mem() where the negative value is used as a signed integer length parameter. This signed value, when subsequently passed to siw_rx_data() and ultimately to skb_copy_bits(), creates a massive unsigned read operation due to the implicit conversion from signed int to size_t. The kernel's memory management subsystem then attempts to copy an enormous amount of data, leading to either memory corruption or system instability as demonstrated by the KASAN report showing a read of size 4294967295 bytes.
This vulnerability directly maps to CWE-190, Integer Overflow or Wraparound, and more specifically aligns with CWE-129, Improper Validation of Array Index, since the validation failure results in an out-of-bounds memory access. From an ATT&CK perspective, this represents a privilege escalation vector through kernel memory corruption (T1068) that could lead to full system compromise, with techniques such as T1547.001 (Registry Run Keys / Startup Folder) potentially being leveraged if successful exploitation occurs. The vulnerability demonstrates poor input validation practices in kernel space networking code and represents a classic example of how peer-controlled data can be used to manipulate internal kernel state through arithmetic underflow conditions.
The recommended mitigation strategy involves implementing early validation of the MPA length field against the minimum required header size for each opcode, ensuring that mpa_len values are always greater than or equal to the sum of the fixed header length and MPA header size. This fix should be implemented at the earliest point where the peer header is fully assembled, as suggested in the analysis, using the existing protocol constraints defined in the kernel's siw_qp.c implementation. The system should terminate the connection with the appropriate error code as specified in RFC 5044 Section 8, ensuring that malformed FPDUs are rejected before they can cause memory corruption. Additionally, implementing comprehensive input validation and bounds checking throughout the packet processing pipeline would prevent similar vulnerabilities from manifesting in other parts of the kernel's networking stack, aligning with security best practices for kernel module development and maintaining the integrity of the kernel's memory management subsystem.