{
  "affected": [
    {
      "ranges": [
        {
          "events": [
            {
              "introduced": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2"
            },
            {
              "fixed": "1065b9efa4126df559b03a849c139ecfae92cd25"
            },
            {
              "fixed": "bc20dbd48c26e743f7e0845020c11ed2ce8b15ee"
            },
            {
              "fixed": "5a564f737ec54d63e8ee221d3ff396d07586d464"
            },
            {
              "fixed": "3c5411fa4944ed99af3d9d1de750ea8169b6dac9"
            },
            {
              "fixed": "145e9afa5b905229b4788bb72c3255f5a5f77508"
            },
            {
              "fixed": "7725cd3b471740fd23d25ed1da722c671fb2a5d3"
            },
            {
              "fixed": "bbe0be67de296176e7243c76e3d9f02f6ae9ff0b"
            },
            {
              "fixed": "915fab69823a14c170dbaa3b41978768e0fe62fc"
            }
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "type": "GIT"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Linux",
        "name": "Kernel"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.6.12"
            },
            {
              "fixed": "5.10.258"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.11.0"
            },
            {
              "fixed": "5.15.209"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "5.16.0"
            },
            {
              "fixed": "6.1.175"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.2.0"
            },
            {
              "fixed": "6.6.142"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.7.0"
            },
            {
              "fixed": "6.12.92"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.13.0"
            },
            {
              "fixed": "6.18.34"
            }
          ],
          "type": "ECOSYSTEM"
        },
        {
          "events": [
            {
              "introduced": "6.19.0"
            },
            {
              "fixed": "7.0.11"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "cna_assigner": "Linux",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64114.json"
  },
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\nipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5\n\nraw_send_hdrinc() validates that the caller-supplied IPv4 header\nfits within the message length:\n\n    iphlen = iph-\u003eihl * 4;\n    err = -EINVAL;\n    if (iphlen \u003e length)\n        goto error_free;\n\n    if (iphlen \u003e= sizeof(*iph)) {\n        /* fix up saddr, tot_len, id, csum, transport_header */\n    }\n\nIt does not, however, reject ihl \u003c 5.  For such a packet the\n\"if (iphlen \u003e= sizeof(*iph))\" branch is skipped, leaving the\ncrafted iphdr untouched, but the packet is still handed to\n__ip_local_out() and onward.  Downstream consumers that read\niph-\u003eihl assume a sane value: net/ipv4/ah4.c:ah_output() in\nparticular subtracts sizeof(struct iphdr) from top_iph-\u003eihl * 4\nand passes the (signed-int-negative, then cast to size_t)\nresult to memcpy(), producing an OOB access of length close to\nSIZE_MAX and a host kernel panic.\n\nAn IPv4 header with ihl \u003c 5 is malformed by definition (RFC 791:\n\"Internet Header Length is the length of the internet header in\n32 bit words ... Note that the minimum value for a correct header\nis 5.\").  The kernel should not be willing to inject such a\npacket into its own output path.\n\nReject \"iphlen \u003c sizeof(*iph)\" alongside the existing\n\"iphlen \u003e length\" check.  This matches the principle that locally\nconstructed packets that re-enter the IP stack must pass the same\nbasic sanity tests that a foreign packet would be subjected to.\n\nOnce this lands, the \"if (iphlen \u003e= sizeof(*iph))\" wrapper around\nthe fixup branch becomes redundant; left in place to keep the\npatch minimal and backport-friendly.  A follow-up can unwrap it.\n\nNote that commit 86f4c90a1c5c (\"ipv4, ipv6: ensure raw socket\nmessage is big enough to hold an IP header\") ensures the message\nbuffer is large enough to hold an iphdr, but does not constrain\nthe self-reported iph-\u003eihl.\n\nReachability: the malformed packet source is any caller with\nCAP_NET_RAW, including an unprivileged process in a user+net\nnamespace on a kernel with CONFIG_USER_NS=y.  The reproduced AH\ncrash also requires a matching xfrm AH policy on the outgoing\nroute; a container granted CAP_NET_ADMIN can install that state\nand policy in its netns.  Loopback bypasses xfrm_output, so the\ntrigger uses a real netdev.\n\nReproduced on UML + KASAN: kernel-mode fault at addr 0x0 with\nmemcpy_orig at the crash site.  Same shape reproduces inside a\nrootless Docker container with --cap-add NET_ADMIN on a stock\ndistro kernel.",
  "id": "CVE-2026-64114",
  "modified": "2026-07-21T03:41:53.963455324Z",
  "published": "2026-07-19T15:40:14.854Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/1065b9efa4126df559b03a849c139ecfae92cd25"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/145e9afa5b905229b4788bb72c3255f5a5f77508"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/3c5411fa4944ed99af3d9d1de750ea8169b6dac9"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/5a564f737ec54d63e8ee221d3ff396d07586d464"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/7725cd3b471740fd23d25ed1da722c671fb2a5d3"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/915fab69823a14c170dbaa3b41978768e0fe62fc"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bbe0be67de296176e7243c76e3d9f02f6ae9ff0b"
    },
    {
      "type": "WEB",
      "url": "https://git.kernel.org/stable/c/bc20dbd48c26e743f7e0845020c11ed2ce8b15ee"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64114.json"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64114"
    },
    {
      "type": "PACKAGE",
      "url": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git"
    }
  ],
  "schema_version": "1.8.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "ipv4: raw: reject IP_HDRINCL packets with ihl \u003c 5"
}