CVE-2026-64414 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
netfilter: handle unreadable frags
sashiko reports: When an skb with unreadable fragments (such as from devmem TCP, where skb_frags_readable(skb) returns false) is processed by the u32 module, skb_copy_bits() will safely return a negative error code [..]
xt_u32: bail out with hotdrop in this case. gather_frags: return -1, just as if we had no fragment header. nfnetlink_queue: restrict to the linear part. nfnetlink_log: restrict to the linear part.
v2: - skb_zerocopy helpers don't copy readable flag, i.e. nfnetlink_queue is broken too xt_u32 shouldn't return true if hotdrop was set.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/26/2026
The vulnerability in question involves a critical flaw within the Linux kernel's netfilter subsystem affecting how fragmented packets with unreadable data are handled during packet processing. This issue specifically impacts the xt_u32 module which processes packet headers for pattern matching operations, where the kernel encounters scenarios involving skb (socket buffer) structures containing fragments that cannot be safely read. The core technical problem arises from the inconsistent handling of unreadable fragments across different netfilter components, creating potential security and stability risks during network packet processing.
When an skb structure contains unreadable fragments typically generated through mechanisms like devmem TCP operations where skb_frags_readable(skb) returns false, the u32 module's processing path fails to properly account for this condition. The skb_copy_bits() function correctly returns a negative error code in such cases, indicating failure to copy data from unreadable fragments, but the subsequent handling within the netfilter chain does not consistently manage this error state. This inconsistency creates a situation where different netfilter components respond differently to the same error condition, with some returning -1 as if no fragment header existed while others attempt to process potentially corrupted data structures.
The operational impact of this vulnerability extends across multiple netfilter subsystems including xt_u32 module, gather_frags functionality, nfnetlink_queue, and nfnetlink_log components. The fix implements a consistent error handling approach where xt_u32 now properly bails out with hotdrop when encountering unreadable fragments, preventing further processing of potentially corrupted packet data. This approach aligns with the principle of fail-safe operation in network security systems and prevents potential exploitation through malformed packet constructs that could cause kernel memory corruption or denial of service conditions. The solution specifically addresses CWE-129 Input Validation and CWE-787 Out-of-bounds Write vulnerabilities by ensuring proper bounds checking and error handling.
The mitigations implemented follow established security practices for kernel-level vulnerability remediation, particularly aligning with ATT&CK technique T1059.003 Command and Scripting Interpreter: Windows Command Shell and similar network attack patterns where attackers might attempt to exploit inconsistent error handling in network stack components. By restricting processing to linear parts of packets and ensuring proper error propagation through the netfilter chain, the fix prevents potential privilege escalation or system compromise scenarios that could arise from improper handling of unreadable packet fragments. This vulnerability demonstrates the critical importance of consistent error handling in kernel space where single points of failure can lead to complete system instability or security breaches.
The resolution specifically addresses the issue where skb_zerocopy helpers were not properly copying readable flags, which affected nfnetlink_queue functionality and created additional attack surface. The updated implementation ensures that xt_u32 module correctly returns false if hotdrop was set, maintaining proper state propagation throughout the netfilter processing pipeline. This comprehensive fix prevents scenarios where malformed packet data could cause kernel memory corruption or lead to privilege escalation attacks targeting the network stack components. The solution represents a defensive programming approach consistent with modern kernel security practices and aligns with industry standards for robust error handling in critical system components.