CVE-2026-64268: Linux Kernel RDMA/siw Buffer Overflow

CVE-2026-64268 Overview

CVE-2026-64268 is an out-of-bounds write vulnerability in the Linux kernel's Soft iWARP (siw) driver, part of the RDMA subsystem. The flaw resides in siw_proc_rresp() inside drivers/infiniband/sw/siw/siw_qp_rx.c, where inbound Read Response DDP segments are placed at sge->laddr + wqe->processed without bounding the running total against the sink buffer length on continuation segments. A remote peer on an established iWARP-over-TCP connection can send Read Response segments that cumulatively exceed the requested RREAD length, driving wqe->processed past the validated sink buffer and writing kernel memory out of bounds.

Critical Impact
A remote unauthenticated peer of an established RDMA connection can trigger kernel out-of-bounds writes, enabling denial of service or potential remote code execution in kernel context.

Affected Products

Linux kernel siw (Soft iWARP) RDMA driver
Systems using software iWARP over TCP for RDMA connectivity
Multiple stable kernel branches (fixes backported across eight commits)

Discovery Timeline

2026-07-25 - CVE-2026-64268 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64268

Vulnerability Analysis

The Soft iWARP driver (siw) implements the iWARP protocol over ordinary TCP sockets, making it reachable from any peer that can complete an RDMA connection. The vulnerable function siw_proc_rresp() processes inbound Read Response DDP (Direct Data Placement) segments in response to an outstanding RREAD (RDMA Read) request.

For each incoming segment, siw_proc_rresp() writes payload to the sink buffer at offset sge->laddr + wqe->processed, then advances wqe->processed by the segment length. The function never revalidates that the accumulated offset remains within the sink buffer boundary on continuation segments.

The two existing validation checks are insufficient. siw_check_sge() resolves and validates sink memory only on the first fragment via the if (!*mem) branch. siw_rresp_check_ntoh() compares cumulative length against wqe->bytes only on the final segment, gated by !frx->more_ddp_segs.

Root Cause

The root cause is missing per-segment boundary enforcement on the receive path for Read Response handling. Companion functions siw_proc_send() and siw_proc_write() correctly bound every segment before placement on both tagged and untagged paths, but siw_proc_rresp() omitted this check. This is an Out-of-Bounds Write [CWE-787] driven by an unchecked cumulative offset.

Attack Vector

A malicious peer with an established iWARP connection answers an outstanding RREAD with Read Response DDP segments that keep the DDP Last flag clear. Each individual segment length passes header validation, but the peer sends more total payload than the RREAD requested. Because siw runs over routable TCP, the attacker needs no local privilege — only the ability to complete an RDMA handshake with the target. Subsequent siw_rx_data() calls then write past the sink buffer into adjacent kernel memory.

No public exploit or proof-of-concept has been published. Technical details are documented across the upstream fix commits, including Kernel Git Commit 3ef7e05 and Kernel Git Commit 423a78f.

Detection Methods for CVE-2026-64268

Indicators of Compromise

Unexpected kernel crashes, oops, or panics with stack traces referencing siw_proc_rresp, siw_rx_data, or siw_qp_rx.c
KASAN reports flagging out-of-bounds writes originating from the siw module
Anomalous inbound TCP traffic on iWARP ports from untrusted peers, particularly Read Response PDUs with DDP Last flag clear across many segments

Detection Strategies

Monitor kernel logs (dmesg, journalctl -k) for siw-related warnings, base-or-bounds DDP errors, or memory corruption signatures
Audit loaded kernel modules for the presence of siw on hosts that do not require software iWARP
Inspect RDMA connection endpoints and correlate remote peers against expected inventory of trusted RDMA participants

Monitoring Recommendations

Enable KASAN on test and staging systems that exercise siw to surface out-of-bounds writes before deployment
Track kernel version and patch level across the fleet to identify hosts running vulnerable siw builds
Alert on abnormal termination of RDMA queue pairs, which the patched code emits when a Read Response would overrun the sink buffer

How to Mitigate CVE-2026-64268

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in the fix commits as soon as vendor updates become available
Unload the siw module (modprobe -r siw) on systems that do not actively use Soft iWARP
Restrict inbound access to iWARP TCP ports using host and network firewalls, permitting only trusted RDMA peers

Patch Information

The fix bounds every Read Response segment before placement, mirroring the checks in siw_proc_send() and siw_proc_write(), and terminates the connection with a base-or-bounds DDP error when a Read Response would overrun the sink buffer. Patches are available in the following upstream commits: 3ef7e05, 423a78f, 595e653, 6bc89f3, 75c93cd, 7d29f7e, a31b6d1, and b2e26c9.

Workarounds

Blacklist the siw module where software iWARP is not required by adding blacklist siw to /etc/modprobe.d/
Segment RDMA traffic to isolated management networks and block iWARP TCP ports at the perimeter
Prefer hardware RDMA providers or alternative transports on hosts that cannot be patched immediately

bash

# Disable the vulnerable siw module until patches are applied
sudo modprobe -r siw
echo 'blacklist siw' | sudo tee /etc/modprobe.d/disable-siw.conf
sudo update-initramfs -u