CVE-2026-64268
published 2026-07-25CVE-2026-64268: In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In…
PriorityP350critical9.8CVSS 3.1
AVNACLPRNUINSUCHIHAH
EPSS
0.71%
52.4th percentile
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: bound Read Response placement to the RREAD length
In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each
inbound Read Response DDP segment at sge->laddr + wqe->processed and then
accumulates wqe->processed, but it never checks the running total against
the sink buffer length on continuation segments. siw_check_sge() resolves
and validates the sink memory only on the first fragment (the if (!*mem)
branch), and siw_rresp_check_ntoh() compares the cumulative length against
wqe->bytes only on the final segment (the !frx->more_ddp_segs guard).
A connected siw peer that answers an outstanding RREAD with Read Response
segments that keep the DDP Last flag clear, carrying more total payload
than the RREAD requested, drives wqe->processed past the validated sink
buffer; the next siw_rx_data() call writes out of bounds at
sge->laddr + wqe->processed. siw runs iWARP over ordinary routable TCP,
so the peer is the remote end of an established RDMA connection and needs
no local privilege.
Bound every segment before placement, exactly as siw_proc_send() and
siw_proc_write() already do for their tagged and untagged paths, and
terminate the connection with a base-or-bounds DDP error when the
Read Response would overrun the sink buffer.
This is the second receive-path length fix for this file. A separate
change rejects an MPA FPDU length that underflows the per-fragment
remainder in the header decode; that guard does not cover this case,
because here each individual segment length is self-consistent and only
the accumulated placement offset overruns the buffer.
Affected
56 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linux | linux | — | — |
| linux | linux | >= 8b6a361b8c482f22ac99c3273285ff16b23fba91 < a31b6d18ded3cc32d9ee85a6ff0726d4274887b2 | a31b6d18ded3cc32d9ee85a6ff0726d4274887b2 |
| linux | linux | >= 8b6a361b8c482f22ac99c3273285ff16b23fba91 < 595e6537ad1a210da32cbb9a7f91aa73090915ba | 595e6537ad1a210da32cbb9a7f91aa73090915ba |
| linux | linux | >= 8b6a361b8c482f22ac99c3273285ff16b23fba91 < 3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf | 3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf |
| linux | linux | >= 8b6a361b8c482f22ac99c3273285ff16b23fba91 < b2e26c955f8dd7e8d3f16c858db05245ea4fa817 | b2e26c955f8dd7e8d3f16c858db05245ea4fa817 |
| linux | linux | >= 8b6a361b8c482f22ac99c3273285ff16b23fba91 < 6bc89f34a4597f9f6d41f7a60c67a3153bfe8851 | 6bc89f34a4597f9f6d41f7a60c67a3153bfe8851 |
| linux | linux | >= 8b6a361b8c482f22ac99c3273285ff16b23fba91 < 423a78ff7928c2601013f73ec6d896f5597d0df5 | 423a78ff7928c2601013f73ec6d896f5597d0df5 |
| linux | linux | >= 8b6a361b8c482f22ac99c3273285ff16b23fba91 < 75c93cd3c421890f49ea93f0b978b9b7bb10e5e3 | 75c93cd3c421890f49ea93f0b978b9b7bb10e5e3 |
| linux | linux | >= 8b6a361b8c482f22ac99c3273285ff16b23fba91 < 7d29f7e9dbd844cae4d3e559cf78324b9642fd6b | 7d29f7e9dbd844cae4d3e559cf78324b9642fd6b |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 5.11 < 5.15.212 | 5.15.212 |
| linux | linux_kernel | >= 5.16 < 6.1.178 | 6.1.178 |
| linux | linux_kernel | >= 5.3 < 5.10.261 | 5.10.261 |
| linux | linux_kernel | >= 6.13 < 6.18.39 | 6.18.39 |
| linux | linux_kernel | >= 6.19 < 7.1.4 | 7.1.4 |
| linux | linux_kernel | >= 6.2 < 6.6.145 | 6.6.145 |
| linux | linux_kernel | >= 6.7 < 6.12.96 | 6.12.96 |
| ubuntu | linux | — | — |
| ubuntu | linux-aws | — | — |
| ubuntu | linux-aws-5.15 | — | — |
| ubuntu | linux-aws-7.0 | — | — |
| ubuntu | linux-aws-fips | — | — |
| ubuntu | linux-azure | — | — |
| ubuntu | linux-azure-5.15 | — | — |
| ubuntu | linux-azure-7.0 | — | — |
CVSS provenance
nvdv3.19.8CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vendor_redhat9.8CRITICAL
vendor_ubuntu9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-10-09·CVSS 5.5
CVE-2026-46086 [MEDIUM] Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the i.MX clock driver in the Linux kernel did not
properly handle certain memory allocation failure conditions, leading to a
null pointer dereference vulnerability. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2022-3114)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptogr
Ubuntu
Linux kernel (Azure CVM) vulnerabilities
vendor_ubuntu·2026-10-06·CVSS 5.5
CVE-2026-68461 [MEDIUM] Linux kernel (Azure CVM) vulnerabilities
Title: Linux kernel (Azure CVM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the i.MX clock driver in the Linux kernel did not
properly handle certain memory allocation failure conditions, leading to a
null pointer dereference vulnerability. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2022-3114)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- ACPI driv
Ubuntu
Linux kernel (GCP) vulnerabilities
vendor_ubuntu·2026-10-06·CVSS 5.5
CVE-2026-31711 [MEDIUM] Linux kernel (GCP) vulnerabilities
Title: Linux kernel (GCP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the i.MX clock driver in the Linux kernel did not
properly handle certain memory allocation failure conditions, leading to a
null pointer dereference vulnerability. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2022-3114)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptograph
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2026-10-06·CVSS 5.5
CVE-2026-31711 [MEDIUM] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the i.MX clock driver in the Linux kernel did not
properly handle certain memory allocation failure conditions, leading to a
null pointer dereference vulnerability. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2022-3114)
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security
Ubuntu
Linux kernel (GCP) vulnerabilities
vendor_ubuntu·2026-10-06·CVSS 5.5
CVE-2026-31711 [MEDIUM] Linux kernel (GCP) vulnerabilities
Title: Linux kernel (GCP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the i.MX clock driver in the Linux kernel did not
properly handle certain memory allocation failure conditions, leading to a
null pointer dereference vulnerability. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2022-3114)
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security is
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-10-06·CVSS 5.5
CVE-2026-68461 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the i.MX clock driver in the Linux kernel did not
properly handle certain memory allocation failure conditions, leading to a
null pointer dereference vulnerability. A local attacker could possibly use
this to cause a denial of service (system crash). (CVE-2022-3114)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- ARM32 architecture;
- ARM64 architecture;
- MIPS architecture;
- PowerPC architecture;
- RISC-V architecture;
- User-Mode Linux (UML);
- x86 architecture;
- Block layer subsystem;
- Cryptographic API
Ubuntu
Linux kernel (Oracle) vulnerabilities
vendor_ubuntu·2026-09-29·CVSS 9.1
CVE-2026-64191 [CRITICAL] Linux kernel (Oracle) vulnerabilities
Title: Linux kernel (Oracle) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were d
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-09-22·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architecture;
Ubuntu
Linux kernel (Azure) vulnerabilities
vendor_ubuntu·2026-09-22·CVSS 9.1
CVE-2026-52938 [CRITICAL] Linux kernel (Azure) vulnerabilities
Title: Linux kernel (Azure) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were di
Ubuntu
Linux kernel (NVIDIA BaseOS) vulnerabilities
vendor_ubuntu·2026-09-22
CVE-2026-64504 Linux kernel (NVIDIA BaseOS) vulnerabilities
Title: Linux kernel (NVIDIA BaseOS) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- Intel NPU Driver;
- ACPI drivers;
- Android drivers;
- Drivers core;
- Compressed RAM block device driver;
- Bluetooth drivers;
- Character device driver;
- Hardware random number generator core;
- CPU frequency scaling framework;
- Hardware crypto device drivers
Ubuntu
Linux kernel (IBM) vulnerabilities
vendor_ubuntu·2026-09-21·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel (IBM) vulnerabilities
Title: Linux kernel (IBM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architec
Ubuntu
Linux kernel (NVIDIA Tegra) vulnerabilities
vendor_ubuntu·2026-09-18·CVSS 9.1
CVE-2026-53358 [CRITICAL] Linux kernel (NVIDIA Tegra) vulnerabilities
Title: Linux kernel (NVIDIA Tegra) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- PowerPC architecture;
- RIS
Ubuntu
Linux kernel (Raspberry Pi) vulnerabilities
vendor_ubuntu·2026-09-18·CVSS 9.1
CVE-2026-64504 [CRITICAL] Linux kernel (Raspberry Pi) vulnerabilities
Title: Linux kernel (Raspberry Pi) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390
Ubuntu
Linux kernel (NVIDIA) vulnerabilities
vendor_ubuntu·2026-09-15
CVE-2026-63869 Linux kernel (NVIDIA) vulnerabilities
Title: Linux kernel (NVIDIA) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- ARM64 architecture;
- RISC-V architecture;
- S390 architecture;
- x86 architecture;
- Block layer subsystem;
- Cryptographic API;
- Compute Acceleration Framework;
- Intel NPU Driver;
- ACPI drivers;
- Android drivers;
- Drivers core;
- Compressed RAM block device driver;
- Bluetooth drivers;
- Character device driver;
- Hardware random number generator core;
- CPU frequency scaling framework;
- Hardware crypto device drivers;
- Buf
Ubuntu
Linux kernel (GCP) vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.1
CVE-2026-52938 [CRITICAL] Linux kernel (GCP) vulnerabilities
Title: Linux kernel (GCP) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
It was discovered that some AMD Zen 2 processors did not properly isolate
shared resources in the operation cache. A local attacker could possibly
use this issue to corrupt instructions executed at a higher privilege
level, resulting in privilege escalation. (CVE-2025-54518)
Several security issues were disc
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.1
CVE-2026-64504 [CRITICAL] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architecture;
Ubuntu
Linux kernel (OEM) vulnerabilities
vendor_ubuntu·2026-09-07·CVSS 9.1
CVE-2026-63869 [CRITICAL] Linux kernel (OEM) vulnerabilities
Title: Linux kernel (OEM) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that some Arm processors could complete a broadcast
translation lookaside buffer (TLB) invalidation before memory writes made
through the invalidated translation were globally observed. A local
attacker could possibly use this to write to memory after permission to do
so had been revoked, bypassing memory protections or escalating privileges.
(CVE-2025-10263)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- ARM64 architecture;
- User-space API (UAPI);
- Kernel build system;
- ARM32 architecture;
- RISC-V architecture;
- S390 architec
Red Hat
kernel: RDMA/siw: bound Read Response placement to the RREAD length
vendor_redhat·2026-07-25·CVSS 9.8
CVE-2026-64268 [CRITICAL] CWE-787 kernel: RDMA/siw: bound Read Response placement to the RREAD length
kernel: RDMA/siw: bound Read Response placement to the RREAD length
No description is available for this CVE.
Package: kernel (Red Hat Enterprise Linux 10) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 8) - Affected
Package: kernel (Red Hat Enterprise Linux 9) - Affected
Package: kernel-rt (Red Hat Enterprise Linux 9) - Affected
VulDB
Linux Kernel up to 7.1.3 siw siw_qp_rx.c siw_proc_rresp processed/laddr out-of-bounds (Nessus ID 329925)
vuldb·2026-07-27
CVE-2026-64268 Linux Kernel up to 7.1.3 siw siw_qp_rx.c siw_proc_rresp processed/laddr out-of-bounds (Nessus ID 329925)
A vulnerability, which was classified as very critical, was found in Linux Kernel up to 7.1.3. This vulnerability affects the function siw_proc_rresp of the file drivers/infiniband/sw/siw/siw_qp_rx.c of the component siw. Executing a manipulation of the argument processed/laddr can lead to out-of-bounds read.
This vulnerability is handled as CVE-2026-64268. The attack can be executed remotely. There is not any exploit available.
You should upgrade the affected component.
GHSA
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each
ghsa_unreviewed·2026-07-25
CVE-2026-64268 In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each
In the Linux kernel, the following vulnerability has been resolved:
RDMA/siw: bound Read Response placement to the RREAD length
In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each
inbound Read Response DDP segment at sge->laddr + wqe->processed and then
accumulates wqe->processed, but it never checks the running total against
the sink buffer length on continuation segments. siw_check_sge() resolves
and validates the sink memory only on the first fragment (the if (!*mem)
branch), and siw_rresp_check_ntoh() compares the cumulative length against
wqe->bytes only on the final segment (the !frx->more_ddp_segs guard).
A connected siw peer that answers an outstanding RREAD with Read Response
segments that keep the DDP Last flag clear, carrying more total payload
than the RRE
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/3ef7e052cbd05a8b13a51a07b185a39ec93ee1cfhttps://git.kernel.org/stable/c/423a78ff7928c2601013f73ec6d896f5597d0df5https://git.kernel.org/stable/c/595e6537ad1a210da32cbb9a7f91aa73090915bahttps://git.kernel.org/stable/c/6bc89f34a4597f9f6d41f7a60c67a3153bfe8851https://git.kernel.org/stable/c/75c93cd3c421890f49ea93f0b978b9b7bb10e5e3https://git.kernel.org/stable/c/7d29f7e9dbd844cae4d3e559cf78324b9642fd6bhttps://git.kernel.org/stable/c/a31b6d18ded3cc32d9ee85a6ff0726d4274887b2https://git.kernel.org/stable/c/b2e26c955f8dd7e8d3f16c858db05245ea4fa817
2026-07-25
Published