CVE-2026-64102: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64102 Overview

CVE-2026-64102 is a Linux kernel vulnerability in the Soft-iWARP (siw) RDMA driver. A malicious connected siw peer can send an iWARP Framed Protocol Data Unit (FPDU) whose Marker PDU Aligned framing (MPA) length field is smaller than the fixed Direct Data Placement (DDP)/RDMAP header for the announced opcode. The undersized value flows into signed integer math in siw_tcp_rx_data(), producing a negative fpdu_part_rem. That negative length is later promoted to size_t in skb_copy_bits(), resulting in a multi-gigabyte out-of-bounds read from kernel memory. KASAN reports a use-after-free during the copy.

Critical Impact
Remote attackers with a connected siw iWARP peer can trigger a kernel out-of-bounds read that can lead to information disclosure, denial of service, or memory corruption on affected Linux systems.

Affected Products

Linux kernel versions containing the Soft-iWARP (siw) RDMA driver
Systems with the siw module loaded and reachable iWARP peers
Distributions shipping vulnerable kernels prior to the fix commits listed by kernel.org

Discovery Timeline

2026-07-19 - CVE-2026-64102 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64102

Vulnerability Analysis

The flaw is an Integer Underflow in the Soft-iWARP receive path. siw_get_hdr() parses the full DDP/RDMAP header using iwarp_pktinfo[opcode].hdr_len, but never validates that the peer-controlled 16-bit big-endian c_hdr->mpa_len field is at least as large as the header it just consumed. siw_tcp_rx_data() then computes:

srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE;

For a tagged WRITE opcode (hdr_len 16, MPA_HDR_SIZE 2), an on-wire mpa_len of 0 produces fpdu_part_rem = -14. Any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int.

Root Cause

The signed fpdu_part_rem flows into siw_proc_write() and siw_proc_rresp() through bytes = min(srx->fpdu_part_rem, srx->skb_new) and is passed to siw_check_mem() as a signed int. The interval check addr + len > mem->va + mem->len still succeeds when len is negative for a valid base address. The negative length ultimately reaches siw_rx_kva()/siw_rx_umem() and skb_copy_bits(), where the header copy branch promotes it to size_t, requesting a copy of roughly 4.29 GB.

Attack Vector

A remote peer with an established siw iWARP connection sends a crafted FPDU with an mpa_len value smaller than the opcode's hdr_len - MPA_HDR_SIZE. The malformed frame is delivered via the standard TCP receive path: tcp_data_ready fires in softirq, tcp_read_sock dispatches to siw_tcp_rx_data, and the underflow propagates into skb_copy_bits. No authentication is required beyond the ability to establish an iWARP session with the target.

Because no verified public exploit code is available, technical details should be sourced from the upstream kernel commits referenced by kernel.org.

Detection Methods for CVE-2026-64102

Indicators of Compromise

KASAN reports containing use-after-free in skb_copy_bits with call traces including siw_rx_kva, siw_rx_data, siw_check_mem, siw_proc_write, and siw_tcp_rx_data.
Kernel log entries showing iWARP connection terminations with TERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START (RFC 5044 Section 8 error code 3).
Unexpected crashes or oopses originating in the siw module on hosts exposing iWARP endpoints.

Detection Strategies

Monitor loaded kernel modules and alert when siw is present on hosts that do not require Soft-iWARP.
Inspect network telemetry for inbound TCP sessions to iWARP ports from untrusted sources.
Correlate kernel ring-buffer messages referencing siw framing errors with the source IP of the peer to identify probing.

Monitoring Recommendations

Ingest dmesg and /var/log/kern.log into a centralized logging platform and alert on siw-prefixed error strings.
Track kernel version inventory across the fleet and flag hosts still running pre-patch kernels with the siw module available.
Enable auditing for modprobe/insmod events targeting siw and related RDMA modules.

How to Mitigate CVE-2026-64102

Immediate Actions Required

Update to a Linux kernel release that includes the upstream fix commits referenced by kernel.org for this CVE.
Unload the siw module (modprobe -r siw) on systems that do not require Soft-iWARP functionality.
Restrict network reachability to iWARP endpoints using host firewalls or network segmentation until patches are applied.

Patch Information

The fix adds the missing invariant at the point where the peer header is fully assembled, comparing mpa_len against iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE and terminating the connection with the correct RFC 5044 framing error class when the check fails. Patched commits are available in the mainline and stable trees: Linux Kernel Commit 0ce1bc9, Linux Kernel Commit 1012896, Linux Kernel Commit 14553be, Linux Kernel Commit 33a8b5e, Linux Kernel Commit 4a3315a, Linux Kernel Commit 683f7cf, Linux Kernel Commit 775b4dc, and Linux Kernel Commit c7c0c0f.

Workarounds

Blacklist the siw module on hosts that do not use Soft-iWARP by adding blacklist siw to /etc/modprobe.d/.
Block inbound TCP traffic to iWARP ports at the perimeter and internal firewalls for hosts that must retain the module.
Limit iWARP peer connectivity to authenticated, trusted network segments only.

bash

# Configuration example
# Disable the vulnerable siw module on non-RDMA hosts
echo 'blacklist siw' | sudo tee /etc/modprobe.d/disable-siw.conf
sudo modprobe -r siw

# Verify the module is not loaded
lsmod | grep siw