CVE-2026-64102

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> RDMA/siw: Reject MPA FPDU length underflow before signed receive math<br /> <br /> A malicious connected siw peer can send an iWARP FPDU whose MPA length<br /> field (c_hdr-&gt;mpa_len, 16 bit big-endian, peer-controlled) is smaller<br /> than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP<br /> parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode]<br /> .hdr_len, but never compares mpa_len against that header length.<br /> <br /> siw_tcp_rx_data() then derives<br /> <br /> srx-&gt;fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd<br /> + MPA_HDR_SIZE;<br /> <br /> where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this<br /> point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest<br /> on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below<br /> hdr_len - MPA_HDR_SIZE underflows to a negative int.<br /> <br /> The signed value then flows into siw_proc_write()/siw_proc_rresp() as<br /> <br /> bytes = min(srx-&gt;fpdu_part_rem, srx-&gt;skb_new);<br /> <br /> is handed to siw_check_mem() as an int len (whose interval check<br /> addr + len &gt; mem-&gt;va + mem-&gt;len is satisfied for a valid base when<br /> len is negative), and reaches siw_rx_data() -&gt; siw_rx_kva() /<br /> siw_rx_umem() -&gt; skb_copy_bits() as a signed copy length. The header<br /> copy branch in skb_copy_bits() promotes that to size_t, producing a<br /> multi-gigabyte read.<br /> <br /> KASAN under a KUnit harness that drives the real kernel TCP receive<br /> path -- a loopback AF_INET socketpair, the malformed FPDU written via<br /> kernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock<br /> dispatching to siw_tcp_rx_data -- reports:<br /> <br /> BUG: KASAN: use-after-free in skb_copy_bits+0x284/0x480<br /> Read of size 4294967295 at addr ffff888...<br /> Call Trace:<br /> skb_copy_bits<br /> siw_rx_kva<br /> siw_rx_data<br /> siw_check_mem<br /> siw_proc_write<br /> siw_tcp_rx_data<br /> __tcp_read_sock<br /> siw_qp_llp_data_ready<br /> tcp_data_ready<br /> tcp_data_queue<br /> <br /> Add the missing invariant at the earliest point where the peer header<br /> is fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly<br /> the value the siw transmitter uses as the minimum mpa_len for each<br /> opcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the<br /> protocol contract. Out-of-range FPDUs terminate the connection with<br /> TERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which<br /> is RFC 5044 Section 8 error code 3 ("Marker and ULPDU Length fields<br /> do not agree on the start of an FPDU"), the correct framing-error<br /> class for this inconsistency.