{
  "affected": [
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:12",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.1.176-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:13",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "6.12.94-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "ecosystem_specific": {
        "urgency": "not yet assigned"
      },
      "package": {
        "ecosystem": "Debian:14",
        "name": "linux"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "7.0.12-1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "details": "In the Linux kernel, the following vulnerability has been resolved:  RDMA/siw: Reject MPA FPDU length underflow before signed receive math  A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr-\u003empa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length.  siw_tcp_rx_data() then derives      srx-\u003efpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd                          + MPA_HDR_SIZE;  where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int.  The signed value then flows into siw_proc_write()/siw_proc_rresp() as      bytes = min(srx-\u003efpdu_part_rem, srx-\u003eskb_new);  is handed to siw_check_mem() as an int len (whose interval check addr + len \u003e mem-\u003eva + mem-\u003elen is satisfied for a valid base when len is negative), and reaches siw_rx_data() -\u003e siw_rx_kva() / siw_rx_umem() -\u003e skb_copy_bits() as a signed copy length. The header copy branch in skb_copy_bits() promotes that to size_t, producing a multi-gigabyte read.  KASAN under a KUnit harness that drives the real kernel TCP receive path -- a loopback AF_INET socketpair, the malformed FPDU written via kernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock dispatching to siw_tcp_rx_data -- reports:      BUG: KASAN: use-after-free in skb_copy_bits+0x284/0x480     Read of size 4294967295 at addr ffff888...     Call Trace:      skb_copy_bits      siw_rx_kva      siw_rx_data      siw_check_mem      siw_proc_write      siw_tcp_rx_data      __tcp_read_sock      siw_qp_llp_data_ready      tcp_data_ready      tcp_data_queue  Add the missing invariant at the earliest point where the peer header is fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly the value the siw transmitter uses as the minimum mpa_len for each opcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the protocol contract. Out-of-range FPDUs terminate the connection with TERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which is RFC 5044 Section 8 error code 3 (\"Marker and ULPDU Length fields do not agree on the start of an FPDU\"), the correct framing-error class for this inconsistency.",
  "id": "DEBIAN-CVE-2026-64102",
  "modified": "2026-09-14T16:47:27.513981693Z",
  "published": "2026-07-19T16:17:51.383Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://security-tracker.debian.org/tracker/CVE-2026-64102"
    }
  ],
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "upstream": [
    "CVE-2026-64102"
  ]
}