CVE-2026-64114

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ipv4: raw: reject IP_HDRINCL packets with ihl ihl * 4;<br /> err = -EINVAL;<br /> if (iphlen &gt; length)<br /> goto error_free;<br /> <br /> if (iphlen &gt;= sizeof(*iph)) {<br /> /* fix up saddr, tot_len, id, csum, transport_header */<br /> }<br /> <br /> It does not, however, reject ihl = sizeof(*iph))" branch is skipped, leaving the<br /> crafted iphdr untouched, but the packet is still handed to<br /> __ip_local_out() and onward. Downstream consumers that read<br /> iph-&gt;ihl assume a sane value: net/ipv4/ah4.c:ah_output() in<br /> particular subtracts sizeof(struct iphdr) from top_iph-&gt;ihl * 4<br /> and passes the (signed-int-negative, then cast to size_t)<br /> result to memcpy(), producing an OOB access of length close to<br /> SIZE_MAX and a host kernel panic.<br /> <br /> An IPv4 header with ihl = sizeof(*iph))" wrapper around<br /> the fixup branch becomes redundant; left in place to keep the<br /> patch minimal and backport-friendly. A follow-up can unwrap it.<br /> <br /> Note that commit 86f4c90a1c5c ("ipv4, ipv6: ensure raw socket<br /> message is big enough to hold an IP header") ensures the message<br /> buffer is large enough to hold an iphdr, but does not constrain<br /> the self-reported iph-&gt;ihl.<br /> <br /> Reachability: the malformed packet source is any caller with<br /> CAP_NET_RAW, including an unprivileged process in a user+net<br /> namespace on a kernel with CONFIG_USER_NS=y. The reproduced AH<br /> crash also requires a matching xfrm AH policy on the outgoing<br /> route; a container granted CAP_NET_ADMIN can install that state<br /> and policy in its netns. Loopback bypasses xfrm_output, so the<br /> trigger uses a real netdev.<br /> <br /> Reproduced on UML + KASAN: kernel-mode fault at addr 0x0 with<br /> memcpy_orig at the crash site. Same shape reproduces inside a<br /> rootless Docker container with --cap-add NET_ADMIN on a stock<br /> distro kernel.