All vulnerabilities
CVE-2026-98323

Linux: RDMA/siw: Bound fragmented header copies by the remaining length

Linux LinuxOperating systems
Open in ThreatlineRecord JSON
CVSS
9.8Critical
ExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)0.56%Chance of exploitation activity in the next 30 days, higher than 45% of CVEs. Scored 23 Oct 2026FIRST EPSS
Fixed in2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7Also 262dcd809723723ed8a4e05437ec7e9c21a8f17e, 8628f8ebf41669302513fb3f0bf0eba38b226742 and 6 moreCVE List
Published6 Oct 2026Updated 19 Oct 2026CVE List

What fixes it

  • 2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7LinuxCVE List
  • 262dcd809723723ed8a4e05437ec7e9c21a8f17eLinuxCVE List
  • 8628f8ebf41669302513fb3f0bf0eba38b226742LinuxCVE List
  • 9ff797e516dbc1ecb73701ec4c24055712d44411LinuxCVE List
  • 5.10.271LinuxCVE List
  • 5.15.222LinuxCVE List
Show all 9 fixed versions

A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.

Description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Bound fragmented header copies by the remaining length

siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write.

Use the number of header bytes already received when calculating the next copy length.

Text from CVE List

Affected versions 26

  • Linuxaffected: e3917c85f41ef1df64e27dc0e46ab0d803c5e73e before 2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7CVE List
  • Linuxaffected: 308cd50f174c95a507527037f4de1a0396aa4325 before af9f5b474a260ad23ffb9793d716a5e3bbce3b48CVE List
  • Linuxaffected: 754209850df8367c954ac1de7671c7430b1f342c before 262dcd809723723ed8a4e05437ec7e9c21a8f17eCVE List
  • Linuxaffected: 754209850df8367c954ac1de7671c7430b1f342c before eb4d7a946970469b3ab0c762432bf161d5b0836cCVE List
  • Linuxaffected: 754209850df8367c954ac1de7671c7430b1f342c before 8628f8ebf41669302513fb3f0bf0eba38b226742CVE List
  • Linuxaffected: 754209850df8367c954ac1de7671c7430b1f342c before b72dcfb9bf1f0f0147cda03dc59e4002a315067fCVE List
  • Linuxaffected: 754209850df8367c954ac1de7671c7430b1f342c before e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9dCVE List
  • Linuxaffected: 754209850df8367c954ac1de7671c7430b1f342c before 9ff797e516dbc1ecb73701ec4c24055712d44411CVE List
  • Linuxaffected: e09caa38e10bcf027100cc22b0e3cc745a39ef0aCVE List
  • Linuxaffected: 0c14f795a9eab9344230f9933798b8ee496f497dCVE List
  • Linuxaffected: 7fada7c6962219b6fc4ff4e62e46a936af110dd9CVE List
  • Linuxaffected: 5.10.150 before 5.10.271CVE List
  • Linuxaffected: 5.15.75 before 5.15.222CVE List
  • Linuxaffected: 5.4.220 before 5.5CVE List
  • Linuxaffected: 5.19.17 before 5.20CVE List
  • Linuxaffected: 6.0.3 before 6.1CVE List
  • Linuxaffected: 6.1CVE List
  • Linuxunaffected: all versions before 6.1CVE List
  • Linuxunaffected: 5.10.271 through 5.10.*CVE List
  • Linuxunaffected: 5.15.222 through 5.15.*CVE List
  • Linuxunaffected: 6.1.189 through 6.1.*CVE List
  • Linuxunaffected: 6.6.158 through 6.6.*CVE List
  • Linuxunaffected: 6.12.112 through 6.12.*CVE List
  • Linuxunaffected: 6.18.54 through 6.18.*CVE List
  • Linuxunaffected: 7.2.8 through 7.2.*CVE List
  • Linuxunaffected: 7.3CVE List

References 8