{"id":"CVE-2026-64009","revision":"46f9e9ddcd024109aa809ea72a44af34","records":[{"revision":"46f9e9ddcd024109aa809ea72a44af34","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-64009","aliases":[],"title":"xfrm: Check for underflow in xfrm_state_mtu","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nxfrm: Check for underflow in xfrm_state_mtu\n\nLeo Lin reported OOB write issue in esp component:\n\n xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned\n modulo-2^32 space using an attacker-influenced \"header_len + authsize +\n net_adj\" subtracted from a small \"mtu\" argument. A nobody user can\n install an IPv4 ESP tunnel SA with a large authentication key\n (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc),\n configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a\n large value. When a single UDP datagram is then sent through the\n tunnel, xfrm_state_mtu() underflows to a near-2^32 value, and\n esp_output() consumes it as a signed int via:\n\n padto = min(x->tfcpad, xfrm_state_mtu(x, mtu_cached))\n esp.tfclen = padto - skb->len (assigned to int)\n\n esp.tfclen ends up negative (e.g. -207). It is sign-extended to size_t\n when passed to memset() inside esp_output_fill_trailer(), producing a\n ~16 EB write of zeroes at skb_tail_pointer(skb). KASAN logs it as\n \"Write of size 18446744073709551537 at addr ffff888...\".\n\nCheck for underflow and return 1. This causes the sendmsg attempt to\nfail with ENETUNREACH.","state":0,"publishedAt":"2026-07-19T14:56:24.448+00:00","modifiedAt":"2026-10-19T20:28:08.23+00:00","affected":[{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"unaffected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/xfrm/xfrm_state.c\"\n ],\n \"versions\": [\n {\n \"version\": \"c5c2523893747f88a83376abad310c8ad13f7197\",\n \"lessThan\": \"8014f70c4e6e5ab101ae3860a614e65e988372e3\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c5c2523893747f88a83376abad310c8ad13f7197\",\n \"lessThan\": \"1021d2877b689a648b27815c854557a917122e93\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c5c2523893747f88a83376abad310c8ad13f7197\",\n \"lessThan\": \"2a41b1b31c61c52b972278ce1732a1443f5e89ed\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c5c2523893747f88a83376abad310c8ad13f7197\",\n \"lessThan\": \"fccd685b32df5aaf6bad4381eeda216468e283f0\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c5c2523893747f88a83376abad310c8ad13f7197\",\n \"lessThan\": \"820e501be8aee4b365d218d83227b314309c5fda\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c5c2523893747f88a83376abad310c8ad13f7197\",\n \"lessThan\": \"82ac903e0b519849647657b8c48d21237ada06a2\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c5c2523893747f88a83376abad310c8ad13f7197\",\n \"lessThan\": \"3db50ceeacb52806d8fe86fb1dfe944df0b9f789\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n },\n {\n \"version\": \"c5c2523893747f88a83376abad310c8ad13f7197\",\n \"lessThan\": \"742b04d0550b0ec89dcbc99537ec88653bd1ad90\",\n \"status\": \"affected\",\n \"versionType\": \"git\"\n }\n ]\n }"},{"ecosystem":"Vendor product","name":"Linux","ranges":[],"versions":[],"rawVersionEvidence":"{\n \"product\": \"Linux\",\n \"vendor\": \"Linux\",\n \"defaultStatus\": \"affected\",\n \"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\n \"programFiles\": [\n \"net/xfrm/xfrm_state.c\"\n ],\n \"versions\": [\n {\n \"version\": \"2.6.22\",\n \"status\": \"affected\"\n },\n {\n \"version\": \"0\",\n \"lessThan\": \"2.6.22\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.10.259\",\n \"lessThanOrEqual\": \"5.10.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"5.15.210\",\n \"lessThanOrEqual\": \"5.15.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.1.176\",\n \"lessThanOrEqual\": \"6.1.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.6.143\",\n \"lessThanOrEqual\": \"6.6.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.12.93\",\n \"lessThanOrEqual\": \"6.12.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"6.18.35\",\n \"lessThanOrEqual\": \"6.18.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.0.12\",\n \"lessThanOrEqual\": \"7.0.*\",\n \"status\": \"unaffected\",\n \"versionType\": \"semver\"\n },\n {\n \"version\": \"7.1\",\n \"lessThanOrEqual\": \"*\",\n \"status\": \"unaffected\",\n \"versionType\": \"original_commit_for_fix\"\n }\n ]\n }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","score":7.8,"severity":"HIGH"}],"references":["https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3","https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93","https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed","https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0","https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda","https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2","https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789","https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64009","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-64009","identifiers":["CVE-2026-64009"]},"retained":false,"historicalAffected":[]}],"coverage":[]}