CVE-2026-64436: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64436 Overview

CVE-2026-64436 is an uninitialized memory use vulnerability in the Linux kernel's af_key (PF_KEY) subsystem. The flaw resides in pfkey_msg2xfrm_state(), which handles IPComp Security Association (SA) creation. The IPComp branch allocates an x->calg object but never initializes the alg_key_len field, leaving uninitialized slab data in that member. When the SA is later cloned during an XFRM_MSG_MIGRATE operation, xfrm_algo_clone() uses that garbage value as a length argument to kmemdup(), producing an out-of-bounds slab read.

Critical Impact
A local user with CAP_NET_ADMIN can trigger a slab out-of-bounds read of thousands of bytes past a 68-byte allocation, exposing kernel slab contents or causing allocation failures and denial of service.

Affected Products

Linux kernel (mainline, versions containing the vulnerable pfkey_msg2xfrm_state() IPComp branch)
Linux stable branches prior to the fix commits listed in kernel.org
Distributions shipping affected kernel versions with CONFIG_XFRM and PF_KEY support enabled

Discovery Timeline

2026-07-25 - CVE-2026-64436 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64436

Vulnerability Analysis

The defect lies in the IPComp handling path of pfkey_msg2xfrm_state() in net/key/af_key.c. When a user adds an IPComp SA via PF_KEY, the kernel allocates a compression algorithm object with kmalloc(sizeof(*x->calg)) and copies only the algorithm name into x->calg->alg_name. Unlike the sibling authentication (x->aalg) and encryption (x->ealg) code paths, the compression branch never assigns calg->alg_key_len = 0. IPComp carries no key material, and the allocation reserves exactly sizeof(struct xfrm_algo) with no room for a key buffer.

The uninitialized alg_key_len becomes dangerous when the SA is cloned. During XFRM_MSG_MIGRATE, xfrm_state_migrate() calls xfrm_state_clone_and_setup(), which invokes xfrm_algo_clone(). That helper computes the copy length as sizeof(*alg) + (alg_key_len + 7) / 8 and passes it to kmemdup(). With garbage in alg_key_len, kmemdup() reads far past the 68-byte source object. KASAN reports confirm reads of 4164 bytes from a kmalloc-96 slab cache.

Root Cause

The root cause is missing field initialization. The IPComp branch of pfkey_msg2xfrm_state() never zeroes calg->alg_key_len after kmalloc(). The XFRM netlink path is not vulnerable because verify_one_alg() enforces that any XFRMA_ALG_COMP attribute is at least xfrm_alg_len() bytes, guaranteeing a self-consistent alg_key_len.

Attack Vector

An attacker with CAP_NET_ADMIN in a user namespace opens a PF_KEY socket, sends SADB_ADD for an IPComp SA (SADB_X_SATYPE_IPCOMP), then issues XFRM_MSG_MIGRATE over netlink. The migration path clones the malformed calg object, triggering the out-of-bounds kmemdup(). Depending on the uninitialized value, the primitive yields a slab-out-of-bounds read or a failed oversized allocation.

// No verified public proof-of-concept code is available.
// Reproduction requires:
//   1. PF_KEY socket -> SADB_ADD with SADB_X_SATYPE_IPCOMP
//   2. Netlink XFRM socket -> XFRM_MSG_MIGRATE targeting that SA
// See kernel commit references for the exact fix.

Detection Methods for CVE-2026-64436

Indicators of Compromise

KASAN reports containing slab-out-of-bounds in kmemdup_noprof originating from xfrm_state_migrate call chains
Kernel warnings or oops messages referencing xfrm_algo_clone, xfrm_state_clone_and_setup, or pfkey_add under abnormal workloads
Unexpected SADB_X_SATYPE_IPCOMP SA creation followed shortly by XFRM_MSG_MIGRATE netlink activity from non-IPsec-management processes

Detection Strategies

Audit PF_KEY socket creation using auditd rules on the socket(AF_KEY, ...) syscall to identify processes performing IPsec state manipulation
Monitor xfrm_user_rcv_msg netlink traffic for XFRM_MSG_MIGRATE messages, correlating with prior IPComp SA additions
Enable KASAN on test and canary kernels to surface the out-of-bounds read reliably during fuzzing or regression testing

Monitoring Recommendations

Alert on unprivileged or unexpected processes acquiring CAP_NET_ADMIN and interacting with AF_KEY or NETLINK_XFRM sockets
Ingest dmesg and /var/log/kern.log into centralized logging to catch KASAN, BUG, or oops traces referencing af_key and xfrm
Track kernel package versions across the fleet to identify hosts still running unpatched kernels

How to Mitigate CVE-2026-64436

Immediate Actions Required

Apply the upstream fix that initializes calg->alg_key_len = 0 in the IPComp branch of pfkey_msg2xfrm_state(), referenced in the Linux kernel stable commits 01b9115b5501, 273c06b81d2e, 3f63d1752d90, 58e82fc3dedb, 6de2a6509176, cea34abc94b0, d129c3177d7b, and e8417353cbd0
Rebuild and deploy patched kernels across all affected Linux distributions and cadence with vendor updates
Restrict CAP_NET_ADMIN in user namespaces where IPsec management is not required

Patch Information

The fix is a one-line initialization in the IPComp branch of pfkey_msg2xfrm_state() that sets calg->alg_key_len to zero, matching the behavior of the aalg and ealg branches. Distribution vendors are backporting the change to supported stable kernels. Consult the Linux kernel stable tree commits for the authoritative patch series.

Workarounds

Disable the af_key module by blacklisting it where PF_KEY is not required, using install af_key /bin/true in /etc/modprobe.d/
Prevent unprivileged user namespaces from acquiring CAP_NET_ADMIN by setting kernel.unprivileged_userns_clone=0 on distributions that expose that sysctl
Restrict NETLINK_XFRM access to trusted management processes through seccomp or Landlock policies

bash

# Blacklist the PF_KEY module where IPsec via PF_KEY is not needed
echo 'install af_key /bin/true' | sudo tee /etc/modprobe.d/disable-af_key.conf
sudo rmmod af_key 2>/dev/null || true

# Disable unprivileged user namespace creation (Debian/Ubuntu sysctl)
echo 'kernel.unprivileged_userns_clone=0' | sudo tee /etc/sysctl.d/99-userns.conf
sudo sysctl --system