ZDF
Sign inSign up

Vulnerabilities

Vulnerability · CVE-2026-64114

ipv4: raw: reject IP_HDRINCL packets with ihl < 5

Published Jul 19, 2026 · catalog updated Oct 22, 2026 · ipv4: raw: reject IP_HDRINCL

Check if you run it

No confirmed exploitation is on record for CVE-2026-64114. EPSS is 0.14%. Act only if a listed version of ipv4: raw: reject IP_HDRINCL is installed.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (ipv4: raw: reject IP_HDRINCL).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.
Severity
High7.8
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
0.14%
Remediation
Not established
Affected products
Linux Kernel

In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IP_HDRINCL packets with ihl ihl * 4; err = -EINVAL; if (iphlen > length) goto error_free; if (iphlen >= sizeof(*iph)) { /* fix up saddr, tot_len, id, csum, transport_header */ } It does not, however, reject ihl = sizeof(*iph))" branch is skipped, leaving the crafted iphdr untouched, but the packet is still handed to __ip_local_out() and onward. Downstream consumers that read iph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in particular subtracts sizeof(struct iphdr) from top_iph->ihl * 4 and passes the (signed-int-negative, then cast to size_t) result to memcpy(), producing an OOB access of length close to SIZE_MAX and a host kernel panic. An IPv4 header with ihl length" check. This matches the principle that locally constructed packets that re-enter the IP stack must pass the same basic sanity tests that a foreign packet would be subjected to. Once this lands, the "if (iphlen >= sizeof(*iph))" wrapper around the fixup branch becomes redundant; left in place to keep the patch minimal and backport-friendly. A follow-up can unwrap it. Note that commit 86f4c90a1c5c ("ipv4, ipv6: ensure raw socket message is big enough to hold an IP header") ensures the message buffer is large enough to hold an iphdr, but does not constrain the self-reported iph->ihl. Reachability: the malformed packet source is any caller with CAP_NET_RAW, including an unprivileged process in a user+net namespace on a kernel with CONFIG_USER_NS=y. The reproduced AH crash also requires a matching xfrm AH policy on the outgoing route; a container granted CAP_NET_ADMIN can install that state and policy in its netns. Loopback bypasses xfrm_output, so the trigger uses a real netdev. Reproduced on UML + KASAN: kernel-mode fault at addr 0x0 with memcpy_orig at the crash site. Same shape reproduces inside a rootless Docker container with --cap-add NET_ADMIN on a stock distro kernel.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • Linux Kernel2.6.12 → 5.10.258; 5.11.0 → 5.15.209; 5.16.0 → 6.1.175

How to fix CVE-2026-64114

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

No confirmed exploitation is on record for CVE-2026-64114. EPSS is 0.14%. Act only if a listed version of ipv4: raw: reject IP_HDRINCL is installed.

Which versions are affected?

Compare what you have installed with Kernel 2.6.12 → 5.10.258; 5.11.0 → 5.15.209; 5.16.0 → 6.1.175. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

No weakness class is stored. EPSS 0.14%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

Timeline

Detection, updates, and resolution for this record.

  1. Jul 19, 2026 · OpenSSF OSV / OSV Scanner

    Detected

    In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IP_HDRINCL packets with ihl ihl * 4; err = -EINVAL; if (iphlen > length) goto error_free; if (iphlen >= sizeof(*iph)) { /* fix up saddr, tot_len, id, csum, transport_header */ } It does not, however, reject ihl = sizeof(*iph))" branch is skipped, leaving the crafted iphdr untouched, but the packet is still handed

  2. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 5.10.258; Kernel fixed in 5.15.209; Kernel fixed in 6.1.175; Kernel fixed in 6.6.142

  3. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Fix available

    Kernel fixed in 5.10.258; 5.11.0

  4. Oct 21, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IP_HDRINCL packets with ihl ihl * 4; err = -EINVAL; if (iphlen > length) goto error_free; if (iphlen >= sizeof(*iph)) { /* fix up saddr, tot_len, id, csum, transport_header */ } It does not, however, reject ihl = sizeof(*iph))" branch is skipped, leaving the crafted iphdr untouched, but the packet is still handed

  5. Oct 22, 2026 · OpenSSF OSV / OSV Scanner

    Updated

    In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IP_HDRINCL packets with ihl ihl * 4; err = -EINVAL; if (iphlen > length) goto error_free; if (iphlen >= sizeof(*iph)) { /* fix up saddr, tot_len, id, csum, transport_header */ } It does not, however, reject ihl = sizeof(*iph))" branch is skipped, leaving the crafted iphdr untouched, but the packet is still handed

Sources

References

Freshness

Last verified in this catalog Oct 23, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.