{"id":"CVE-2026-64009","state":"PUBLISHED","title":"xfrm: Check for underflow in xfrm_state_mtu","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Check for underflow in xfrm_state_mtu\n\nLeo Lin reported OOB write issue in esp component:\n\n  xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\n  modulo-2^32 space using an attacker-influenced \"header_len + authsize +\n  net_adj\" subtracted from a small \"mtu\" argument. A nobody user can\n  install an IPv4 ESP tunnel SA with a large authentication key\n  (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\n  configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\n  large value. When a single UDP datagram is then sent through the\n  tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\n  esp_output() consumes it as a signed int via:\n\n        padto      = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached))\n        esp.tfclen = padto - skb->len   (assigned to int)\n\n  esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\n  when passed to memset() inside esp_output_fill_trailer(), producing a\n  ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n  \"Write of size 18446744073709551537 at addr ffff888...\".\n\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH.","publishedAt":"2026-07-19T14:56:24.448Z","updatedAt":"2026-10-19T20:28:08.230Z","severity":{"score":7.8,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"8014f70c4e6e5ab101ae3860a614e65e988372e3","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"1021d2877b689a648b27815c854557a917122e93","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"2a41b1b31c61c52b972278ce1732a1443f5e89ed","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"fccd685b32df5aaf6bad4381eeda216468e283f0","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"820e501be8aee4b365d218d83227b314309c5fda","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"82ac903e0b519849647657b8c48d21237ada06a2","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"3db50ceeacb52806d8fe86fb1dfe944df0b9f789","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"742b04d0550b0ec89dcbc99537ec88653bd1ad90","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/xfrm/xfrm_state.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.22","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.22","versionType":"semver"},{"version":"5.10.259","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.210","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.176","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.143","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.93","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.35","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.12","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/xfrm/xfrm_state.c"]}],"references":["https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3","https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93","https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed","https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0","https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda","https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2","https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789","https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90"],"weaknesses":["CWE-191"],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64009.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64009","state":"PUBLISHED","datePublished":"2026-07-19T14:56:24.448Z","dateUpdated":"2026-10-19T20:28:08.230Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T07:54:57.026Z"},"containers":{"cna":{"title":"xfrm: Check for underflow in xfrm_state_mtu","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Check for underflow in xfrm_state_mtu\n\nLeo Lin reported OOB write issue in esp component:\n\n  xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\n  modulo-2^32 space using an attacker-influenced \"header_len + authsize +\n  net_adj\" subtracted from a small \"mtu\" argument. A nobody user can\n  install an IPv4 ESP tunnel SA with a large authentication key\n  (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\n  configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\n  large value. When a single UDP datagram is then sent through the\n  tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\n  esp_output() consumes it as a signed int via:\n\n        padto      = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached))\n        esp.tfclen = padto - skb->len   (assigned to int)\n\n  esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\n  when passed to memset() inside esp_output_fill_trailer(), producing a\n  ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n  \"Write of size 18446744073709551537 at addr ffff888...\".\n\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"8014f70c4e6e5ab101ae3860a614e65e988372e3","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"1021d2877b689a648b27815c854557a917122e93","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"2a41b1b31c61c52b972278ce1732a1443f5e89ed","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"fccd685b32df5aaf6bad4381eeda216468e283f0","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"820e501be8aee4b365d218d83227b314309c5fda","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"82ac903e0b519849647657b8c48d21237ada06a2","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"3db50ceeacb52806d8fe86fb1dfe944df0b9f789","versionType":"git"},{"version":"c5c2523893747f88a83376abad310c8ad13f7197","status":"affected","lessThan":"742b04d0550b0ec89dcbc99537ec88653bd1ad90","versionType":"git"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/xfrm/xfrm_state.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"2.6.22","status":"affected"},{"version":"0","status":"unaffected","lessThan":"2.6.22","versionType":"semver"},{"version":"5.10.259","status":"unaffected","lessThanOrEqual":"5.10.*","versionType":"semver"},{"version":"5.15.210","status":"unaffected","lessThanOrEqual":"5.15.*","versionType":"semver"},{"version":"6.1.176","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.143","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.93","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.35","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.0.12","status":"unaffected","lessThanOrEqual":"7.0.*","versionType":"semver"},{"version":"7.1","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["net/xfrm/xfrm_state.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3"},{"url":"https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93"},{"url":"https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed"},{"url":"https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0"},{"url":"https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda"},{"url":"https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2"},{"url":"https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789"},{"url":"https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The vulnerability is triggered on the local ESP output path when a process sends a UDP datagram through an attacker-configured XFRM tunnel via sendmsg(); remote peers cannot install XFRM SAs, set interface MTU, or control XFRMA_TFCPAD on the victim system.\nAC:L - The attacker fully controls all preconditions (ESP tunnel SA with large HMAC-SHA512 auth, MTU 68, XFRMA_TFCPAD, and UDP payload size) and can trigger the underflow deterministically with a single datagram as demonstrated in the fix commit.\nPR:L - XFRM state/policy installation and interface MTU configuration require CAP_NET_ADMIN, which an unprivileged local user can obtain in a user namespace via unshare -Urn; this is the most severe reasonable deployment scenario on multi-tenant hosts.\nUI:N - Exploitation requires only the attacker's own netlink configuration and socket send operations; no action from another user or administrator is needed.\nS:U - The vulnerability corrupts kernel heap memory from a local attacker's security context, constituting standard kernel privilege escalation rather than crossing a VM or hypervisor boundary.\nC:H - The bug produces a massive out-of-bounds write via memset() at the skb tail pointer; such heap corruption is exploitable for arbitrary kernel memory disclosure in addition to the demonstrated KASAN-detected write primitive.\nI:H - A negative tfclen sign-extended to size_t causes an enormous memset() OOB write at skb_tail_pointer(skb), providing a memory corruption primitive that can be leveraged for arbitrary kernel writes and code execution.\nA:H - The OOB write reliably triggers kernel oops/panic (KASAN reports a write of size 18446744073709551537 bytes), causing immediate system crash and denial of service."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-05T12:38:09.114Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"5.10.259"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"5.15.210"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"6.1.176"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"6.6.143"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"6.12.93"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"6.18.35"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"7.0.12"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"2.6.22","versionEndExcluding":"7.1"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-64009","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:35:15.345325Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-191","lang":"en","type":"CWE","description":"CWE-191 Integer Underflow (Wrap or Wraparound)"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T20:28:08.230Z"}}]}}}