CVE-2026-64009 Overview
CVE-2026-64009 is an integer underflow vulnerability in the Linux kernel's xfrm (IPsec transformation) subsystem. The flaw resides in the xfrm_state_mtu() function, which performs unsigned arithmetic that can wrap around when attacker-influenced values exceed a small MTU argument. The resulting value is later consumed as a signed integer by esp_output() and passed to memset() inside esp_output_fill_trailer(), triggering an out-of-bounds write of approximately 16 exabytes at skb_tail_pointer(skb). A local unprivileged user with the ability to configure IPsec state can trigger the underflow, leading to kernel memory corruption.
Critical Impact
A local low-privileged user can trigger a kernel out-of-bounds write via a crafted IPv4 ESP tunnel security association, resulting in memory corruption and potential local privilege escalation.
Affected Products
- Linux kernel with xfrm (IPsec) and esp transformation support
- Stable kernel branches referenced in the upstream fix commits
- Distributions shipping vulnerable kernels prior to the referenced patches
Discovery Timeline
- Vulnerability reported by Leo Lin
- 2026-07-19 - CVE-2026-64009 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64009
Vulnerability Analysis
The xfrm_state_mtu() function returns a u32 but performs its arithmetic in unsigned modulo-2^32 space. It subtracts an attacker-influenced expression header_len + authsize + net_adj from a small mtu argument. When the subtracted terms exceed mtu, the result underflows to a value near 2^32.
The caller esp_output() uses the returned value as follows:
- padto = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached))
- esp.tfclen = padto - skb->len assigned to an int
Because esp.tfclen becomes negative (for example, -207), it is sign-extended to size_t when passed to memset() inside esp_output_fill_trailer(). This produces a write of size 18446744073709551537 bytes at skb_tail_pointer(skb), which KASAN reports as an out-of-bounds write.
Root Cause
The root cause is missing underflow validation in xfrm_state_mtu() combined with an unsafe signed/unsigned type conversion in esp_output(). Arithmetic performed in unsigned space wraps silently, and the wrapped value is later reinterpreted as a signed int, producing a large negative length that propagates into a memory-write primitive.
Attack Vector
A nobody (unprivileged) user in a namespace permitting xfrm configuration can:
- Install an IPv4 ESP tunnel security association with a large authentication key such as hmac(sha512) using a 64-byte key and 64-byte truncation via XFRMA_ALG_AUTH_TRUNC.
- Configure a small interface MTU of 68 bytes.
- Set XFRMA_TFCPAD to a large value.
- Send a single UDP datagram through the tunnel.
The resulting memset() writes zeroes far past the socket buffer, corrupting adjacent kernel memory. The upstream fix checks for underflow in xfrm_state_mtu() and returns 1, causing the sendmsg attempt to fail with ENETUNREACH.
No public proof-of-concept code has been released. Technical details are documented across upstream commits including 1021d287, 2a41b1b3, 3db50cee, 742b04d0, 8014f70c, 820e501b, 82ac903e, and fccd685b in the stable kernel tree.
Detection Methods for CVE-2026-64009
Indicators of Compromise
- KASAN kernel log entries reporting Write of size 18446744073709551537 at addr ffff888... near esp_output_fill_trailer or skb_tail_pointer.
- Unexpected kernel panics or oops messages referencing xfrm_state_mtu, esp_output, or esp_output_fill_trailer.
- sendmsg calls returning ENETUNREACH on IPsec tunnels after patching, indicating triggered underflow protection.
Detection Strategies
- Audit systems for unprivileged users or containers with CAP_NET_ADMIN in a user namespace, which is required to install xfrm state.
- Monitor xfrm netlink activity for the combination of large XFRMA_ALG_AUTH_TRUNC keys, low interface MTUs (below 100 bytes), and large XFRMA_TFCPAD values.
- Enable KASAN on test and staging kernels to catch out-of-bounds writes during regression testing.
Monitoring Recommendations
- Ship kernel dmesg and auditd logs to a centralized logging platform and alert on any KASAN or oops output referencing xfrm or esp_output.
- Track new IPsec SA creations via AUDIT_MAC_IPSEC_ADDSA audit records and correlate with process ownership.
- Baseline expected MTU and IPsec configurations across the fleet and alert on outliers such as 68-byte interface MTUs paired with ESP tunnels.
How to Mitigate CVE-2026-64009
Immediate Actions Required
- Apply the upstream stable-tree patches referenced in commits 1021d287, 2a41b1b3, 3db50cee, 742b04d0, 8014f70c, 820e501b, 82ac903e, and fccd685b.
- Update to distribution kernel builds that incorporate the xfrm_state_mtu underflow check.
- Restrict CAP_NET_ADMIN inside unprivileged user namespaces on multi-tenant hosts.
Patch Information
The fix adds an explicit underflow check inside xfrm_state_mtu() that returns 1 when header_len + authsize + net_adj exceeds mtu. This causes downstream callers such as esp_output() to fail cleanly with ENETUNREACH instead of computing a negative tfclen. Patch details are available in the Linux stable kernel commit history.
Workarounds
- Disable unprivileged user namespaces by setting kernel.unprivileged_userns_clone=0 where operationally acceptable.
- Remove CAP_NET_ADMIN from container workloads that do not require IPsec configuration.
- Block loading of the esp4, esp6, and xfrm_user modules on hosts that do not use IPsec by adding entries to /etc/modprobe.d/.
# Configuration example: prevent unprivileged xfrm/esp usage
echo 'install esp4 /bin/true' | sudo tee /etc/modprobe.d/disable-esp.conf
echo 'install esp6 /bin/true' | sudo tee -a /etc/modprobe.d/disable-esp.conf
echo 'install xfrm_user /bin/true' | sudo tee -a /etc/modprobe.d/disable-esp.conf
sudo sysctl -w kernel.unprivileged_userns_clone=0
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
