CVE-2026-64009 (GCVE-0-2026-64009)
Vulnerability from cvelistv5 – Published: 2026-07-19 14:56 – Updated: 2026-10-19 20:28
VLAI
EPSS
VEX
Title
xfrm: Check for underflow in xfrm_state_mtu
Summary
In the Linux kernel, the following vulnerability has been resolved:
xfrm: Check for underflow in xfrm_state_mtu
Leo Lin reported OOB write issue in esp component:
xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned
modulo-2^32 space using an attacker-influenced "header_len + authsize +
net_adj" subtracted from a small "mtu" argument. A nobody user can
install an IPv4 ESP tunnel SA with a large authentication key
(XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),
configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a
large value. When a single UDP datagram is then sent through the
tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and
esp_output() consumes it as a signed int via:
padto = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached))
esp.tfclen = padto - skb->len (assigned to int)
esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t
when passed to memset() inside esp_output_fill_trailer(), producing a
~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as
"Write of size 18446744073709551537 at addr ffff888...".
Check for underflow and return 1. This causes the sendmsg attempt to
fail with ENETUNREACH.
Severity
7.8 (High)
SSVC
Exploitation: none
Automatable: no
Technical Impact: total
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-10-16 15:35 UTC
CWE
- CWE-191 - Integer Underflow (Wrap or Wraparound)
Assigner
References
8 references
Impacted products
2 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| Linux | Linux |
Affected:
c5c2523893747f88a83376abad310c8ad13f7197 , < 8014f70c4e6e5ab101ae3860a614e65e988372e3
(git)
Affected: c5c2523893747f88a83376abad310c8ad13f7197 , < 1021d2877b689a648b27815c854557a917122e93 (git) Affected: c5c2523893747f88a83376abad310c8ad13f7197 , < 2a41b1b31c61c52b972278ce1732a1443f5e89ed (git) Affected: c5c2523893747f88a83376abad310c8ad13f7197 , < fccd685b32df5aaf6bad4381eeda216468e283f0 (git) Affected: c5c2523893747f88a83376abad310c8ad13f7197 , < 820e501be8aee4b365d218d83227b314309c5fda (git) Affected: c5c2523893747f88a83376abad310c8ad13f7197 , < 82ac903e0b519849647657b8c48d21237ada06a2 (git) Affected: c5c2523893747f88a83376abad310c8ad13f7197 , < 3db50ceeacb52806d8fe86fb1dfe944df0b9f789 (git) Affected: c5c2523893747f88a83376abad310c8ad13f7197 , < 742b04d0550b0ec89dcbc99537ec88653bd1ad90 (git) |
guessed | |
| Linux | Linux |
Affected:
2.6.22
Unaffected: 0 , < 2.6.22 (semver) Unaffected: 5.10.259 , ≤ 5.10.* (semver) Unaffected: 5.15.210 , ≤ 5.15.* (semver) Unaffected: 6.1.176 , ≤ 6.1.* (semver) Unaffected: 6.6.143 , ≤ 6.6.* (semver) Unaffected: 6.12.93 , ≤ 6.12.* (semver) Unaffected: 6.18.35 , ≤ 6.18.* (semver) Unaffected: 7.0.12 , ≤ 7.0.* (semver) Unaffected: 7.1 , ≤ * (original_commit_for_fix) |
guessed |
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64009",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:15.345325Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-191",
"description": "CWE-191 Integer Underflow (Wrap or Wraparound)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-19T20:28:08.230Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8014f70c4e6e5ab101ae3860a614e65e988372e3",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "1021d2877b689a648b27815c854557a917122e93",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "2a41b1b31c61c52b972278ce1732a1443f5e89ed",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "fccd685b32df5aaf6bad4381eeda216468e283f0",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "820e501be8aee4b365d218d83227b314309c5fda",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "82ac903e0b519849647657b8c48d21237ada06a2",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "3db50ceeacb52806d8fe86fb1dfe944df0b9f789",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "742b04d0550b0ec89dcbc99537ec88653bd1ad90",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.22"
},
{
"lessThan": "2.6.22",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Check for underflow in xfrm_state_mtu\n\nLeo Lin reported OOB write issue in esp component:\n\n xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\n modulo-2^32 space using an attacker-influenced \"header_len + authsize +\n net_adj\" subtracted from a small \"mtu\" argument. A nobody user can\n install an IPv4 ESP tunnel SA with a large authentication key\n (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\n configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\n large value. When a single UDP datagram is then sent through the\n tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\n esp_output() consumes it as a signed int via:\n\n padto = min(x-\u003etfcpad, xfrm_state_mtu(x, mtu_cached))\n esp.tfclen = padto - skb-\u003elen (assigned to int)\n\n esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\n when passed to memset() inside esp_output_fill_trailer(), producing a\n ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n \"Write of size 18446744073709551537 at addr ffff888...\".\n\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is triggered on the local ESP output path when a process sends a UDP datagram through an attacker-configured XFRM tunnel via sendmsg(); remote peers cannot install XFRM SAs, set interface MTU, or control XFRMA_TFCPAD on the victim system.\nAC:L - The attacker fully controls all preconditions (ESP tunnel SA with large HMAC-SHA512 auth, MTU 68, XFRMA_TFCPAD, and UDP payload size) and can trigger the underflow deterministically with a single datagram as demonstrated in the fix commit.\nPR:L - XFRM state/policy installation and interface MTU configuration require CAP_NET_ADMIN, which an unprivileged local user can obtain in a user namespace via unshare -Urn; this is the most severe reasonable deployment scenario on multi-tenant hosts.\nUI:N - Exploitation requires only the attacker\u0027s own netlink configuration and socket send operations; no action from another user or administrator is needed.\nS:U - The vulnerability corrupts kernel heap memory from a local attacker\u0027s security context, constituting standard kernel privilege escalation rather than crossing a VM or hypervisor boundary.\nC:H - The bug produces a massive out-of-bounds write via memset() at the skb tail pointer; such heap corruption is exploitable for arbitrary kernel memory disclosure in addition to the demonstrated KASAN-detected write primitive.\nI:H - A negative tfclen sign-extended to size_t causes an enormous memset() OOB write at skb_tail_pointer(skb), providing a memory corruption primitive that can be leveraged for arbitrary kernel writes and code execution.\nA:H - The OOB write reliably triggers kernel oops/panic (KASAN reports a write of size 18446744073709551537 bytes), causing immediate system crash and denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:09.114Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3"
},
{
"url": "https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93"
},
{
"url": "https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed"
},
{
"url": "https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0"
},
{
"url": "https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda"
},
{
"url": "https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2"
},
{
"url": "https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789"
},
{
"url": "https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90"
}
],
"title": "xfrm: Check for underflow in xfrm_state_mtu",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64009",
"datePublished": "2026-07-19T14:56:24.448Z",
"dateReserved": "2026-07-19T07:54:57.026Z",
"dateUpdated": "2026-10-19T20:28:08.230Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-64009",
"date": "2026-10-20",
"epss": "0.00143",
"percentile": "0.03289"
},
"nvd": {
"cve": {
"affected": [
{
"affectedData": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8014f70c4e6e5ab101ae3860a614e65e988372e3",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "1021d2877b689a648b27815c854557a917122e93",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "2a41b1b31c61c52b972278ce1732a1443f5e89ed",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "fccd685b32df5aaf6bad4381eeda216468e283f0",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "820e501be8aee4b365d218d83227b314309c5fda",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "82ac903e0b519849647657b8c48d21237ada06a2",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "3db50ceeacb52806d8fe86fb1dfe944df0b9f789",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "742b04d0550b0ec89dcbc99537ec88653bd1ad90",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.22"
},
{
"lessThan": "2.6.22",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D88CE404-F14A-49F7-862B-23D7205FD4C4",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "5E938CDF-D1C4-43D0-98DC-9E11B6B55801",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "5.11",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "C4446623-5F2B-4DD8-8666-9FAAC285A757",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "5.16",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9062F1CD-CAD6-4EA2-A73F-C06D4A887B8C",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "6.2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "1E73413E-0629-41AA-A4D3-5A3D10A0BD63",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "6.7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "0FCCB23A-7629-4386-93B6-B119237C4382",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "6.13",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"matchCriteriaId": "9161A938-0FA8-44BC-95FE-C5A271601AB3",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "6.19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc5:*:*:*:*:*:*",
"matchCriteriaId": "81DFF19E-9CF8-49C6-8C36-1E4038622933",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Check for underflow in xfrm_state_mtu\n\nLeo Lin reported OOB write issue in esp component:\n\n xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\n modulo-2^32 space using an attacker-influenced \"header_len + authsize +\n net_adj\" subtracted from a small \"mtu\" argument. A nobody user can\n install an IPv4 ESP tunnel SA with a large authentication key\n (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\n configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\n large value. When a single UDP datagram is then sent through the\n tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\n esp_output() consumes it as a signed int via:\n\n padto = min(x-\u003etfcpad, xfrm_state_mtu(x, mtu_cached))\n esp.tfclen = padto - skb-\u003elen (assigned to int)\n\n esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\n when passed to memset() inside esp_output_fill_trailer(), producing a\n ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n \"Write of size 18446744073709551537 at addr ffff888...\".\n\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH."
}
],
"id": "CVE-2026-64009",
"lastModified": "2026-10-19T21:17:18.950",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "HIGH",
"baseScore": 7.8,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "LOW",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 5.9,
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-64009",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:15.345325Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-07-19T16:17:40.663",
"references": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2"
},
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
],
"url": "https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0"
}
],
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-787"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-191"
}
],
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
]
}
},
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-10-16T23:10:49+00:00",
"cve": "CVE-2026-64009",
"id": "CVE-2026-64009",
"initial_release_date": "2026-07-19T00:00:00+00:00",
"product_status:known_affected": "261",
"product_status:under_investigation": "14",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "kernel: xfrm: Check for underflow in xfrm_state_mtu",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64009.json",
"version": "3"
},
"vulnrichment": {
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-64009",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-10-16T15:35:15.345325Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-10-16T15:35:15.906Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"defaultStatus": "unaffected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"lessThan": "8014f70c4e6e5ab101ae3860a614e65e988372e3",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "1021d2877b689a648b27815c854557a917122e93",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "2a41b1b31c61c52b972278ce1732a1443f5e89ed",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "fccd685b32df5aaf6bad4381eeda216468e283f0",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "820e501be8aee4b365d218d83227b314309c5fda",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "82ac903e0b519849647657b8c48d21237ada06a2",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "3db50ceeacb52806d8fe86fb1dfe944df0b9f789",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
},
{
"lessThan": "742b04d0550b0ec89dcbc99537ec88653bd1ad90",
"status": "affected",
"version": "c5c2523893747f88a83376abad310c8ad13f7197",
"versionType": "git"
}
]
},
{
"defaultStatus": "affected",
"product": "Linux",
"programFiles": [
"net/xfrm/xfrm_state.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.22"
},
{
"lessThan": "2.6.22",
"status": "unaffected",
"version": "0",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.10.*",
"status": "unaffected",
"version": "5.10.259",
"versionType": "semver"
},
{
"lessThanOrEqual": "5.15.*",
"status": "unaffected",
"version": "5.15.210",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.1.*",
"status": "unaffected",
"version": "6.1.176",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.6.*",
"status": "unaffected",
"version": "6.6.143",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.12.*",
"status": "unaffected",
"version": "6.12.93",
"versionType": "semver"
},
{
"lessThanOrEqual": "6.18.*",
"status": "unaffected",
"version": "6.18.35",
"versionType": "semver"
},
{
"lessThanOrEqual": "7.0.*",
"status": "unaffected",
"version": "7.0.12",
"versionType": "semver"
},
{
"lessThanOrEqual": "*",
"status": "unaffected",
"version": "7.1",
"versionType": "original_commit_for_fix"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.10.259",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "5.15.210",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.1.176",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.6.143",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.12.93",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "6.18.35",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.0.12",
"versionStartIncluding": "2.6.22",
"vulnerable": true
},
{
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "7.1",
"versionStartIncluding": "2.6.22",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Check for underflow in xfrm_state_mtu\n\nLeo Lin reported OOB write issue in esp component:\n\n xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\n modulo-2^32 space using an attacker-influenced \"header_len + authsize +\n net_adj\" subtracted from a small \"mtu\" argument. A nobody user can\n install an IPv4 ESP tunnel SA with a large authentication key\n (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\n configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\n large value. When a single UDP datagram is then sent through the\n tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\n esp_output() consumes it as a signed int via:\n\n padto = min(x-\u003etfcpad, xfrm_state_mtu(x, mtu_cached))\n esp.tfclen = padto - skb-\u003elen (assigned to int)\n\n esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\n when passed to memset() inside esp_output_fill_trailer(), producing a\n ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n \"Write of size 18446744073709551537 at addr ffff888...\".\n\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH."
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"scenarios": [
{
"lang": "en",
"value": "AV:L - The vulnerability is triggered on the local ESP output path when a process sends a UDP datagram through an attacker-configured XFRM tunnel via sendmsg(); remote peers cannot install XFRM SAs, set interface MTU, or control XFRMA_TFCPAD on the victim system.\nAC:L - The attacker fully controls all preconditions (ESP tunnel SA with large HMAC-SHA512 auth, MTU 68, XFRMA_TFCPAD, and UDP payload size) and can trigger the underflow deterministically with a single datagram as demonstrated in the fix commit.\nPR:L - XFRM state/policy installation and interface MTU configuration require CAP_NET_ADMIN, which an unprivileged local user can obtain in a user namespace via unshare -Urn; this is the most severe reasonable deployment scenario on multi-tenant hosts.\nUI:N - Exploitation requires only the attacker\u0027s own netlink configuration and socket send operations; no action from another user or administrator is needed.\nS:U - The vulnerability corrupts kernel heap memory from a local attacker\u0027s security context, constituting standard kernel privilege escalation rather than crossing a VM or hypervisor boundary.\nC:H - The bug produces a massive out-of-bounds write via memset() at the skb tail pointer; such heap corruption is exploitable for arbitrary kernel memory disclosure in addition to the demonstrated KASAN-detected write primitive.\nI:H - A negative tfclen sign-extended to size_t causes an enormous memset() OOB write at skb_tail_pointer(skb), providing a memory corruption primitive that can be leveraged for arbitrary kernel writes and code execution.\nA:H - The OOB write reliably triggers kernel oops/panic (KASAN reports a write of size 18446744073709551537 bytes), causing immediate system crash and denial of service."
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-05T12:38:09.114Z",
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"shortName": "Linux"
},
"references": [
{
"url": "https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3"
},
{
"url": "https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93"
},
{
"url": "https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed"
},
{
"url": "https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0"
},
{
"url": "https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda"
},
{
"url": "https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2"
},
{
"url": "https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789"
},
{
"url": "https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90"
}
],
"title": "xfrm: Check for underflow in xfrm_state_mtu",
"x_generator": {
"engine": "bippy-1.2.0"
}
}
},
"cveMetadata": {
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"assignerShortName": "Linux",
"cveId": "CVE-2026-64009",
"datePublished": "2026-07-19T14:56:24.448Z",
"dateReserved": "2026-07-19T07:54:57.026Z",
"dateUpdated": "2026-10-16T15:42:18.442Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.