CVE-2026-64414

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> netfilter: handle unreadable frags<br /> <br /> sashiko reports:<br /> When an skb with unreadable fragments (such as from devmem TCP, where<br /> skb_frags_readable(skb) returns false) is processed by the u32 module,<br /> skb_copy_bits() will safely return a negative error code [..]<br /> <br /> xt_u32: bail out with hotdrop in this case.<br /> gather_frags: return -1, just as if we had no fragment header.<br /> nfnetlink_queue: restrict to the linear part.<br /> nfnetlink_log: restrict to the linear part.<br /> <br /> v2:<br /> - skb_zerocopy helpers don&amp;#39;t copy readable flag, i.e. nfnetlink_queue<br /> is broken too<br /> xt_u32 shouldn&amp;#39;t return true if hotdrop was set.