CVE-2026-98323
Description
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length.
How to fix
- Linux Linux2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7, af9f5b474a260ad23ffb9793d716a5e3bbce3b48, 262dcd809723723ed8a4e05437ec7e9c21a8f17e, eb4d7a946970469b3ab0c762432bf161d5b0836c, 8628f8ebf41669302513fb3f0bf0eba38b226742, b72dcfb9bf1f0f0147cda03dc59e4002a315067f, e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d, 9ff797e516dbc1ecb73701ec4c24055712d44411, 5.10.271, 5.15.222, 5.5, 5.20, 6.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | e3917c85f41ef1df64e27dc0e46ab0d803c5e73e ≤ v < 2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7, 308cd50f174c95a507527037f4de1a0396aa4325 ≤ v < af9f5b474a260ad23ffb9793d716a5e3bbce3b48, 754209850df8367c954ac1de7671c7430b1f342c ≤ v < 262dcd809723723ed8a4e05437ec7e9c21a8f17e, 754209850df8367c954ac1de7671c7430b1f342c ≤ v < eb4d7a946970469b3ab0c762432bf161d5b0836c, 754209850df8367c954ac1de7671c7430b1f342c ≤ v < 8628f8ebf41669302513fb3f0bf0eba38b226742, 754209850df8367c954ac1de7671c7430b1f342c ≤ v < b72dcfb9bf1f0f0147cda03dc59e4002a315067f, 754209850df8367c954ac1de7671c7430b1f342c ≤ v < e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d, 754209850df8367c954ac1de7671c7430b1f342c ≤ v < 9ff797e516dbc1ecb73701ec4c24055712d44411, e09caa38e10bcf027100cc22b0e3cc745a39ef0a, 0c14f795a9eab9344230f9933798b8ee496f497d, 7fada7c6962219b6fc4ff4e62e46a936af110dd9, 5.10.150 ≤ v < 5.10.271, 5.15.75 ≤ v < 5.15.222, 5.4.220 ≤ v < 5.5, 5.19.17 ≤ v < 5.20, 6.0.3 ≤ v < 6.1, 6.1 | 2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7, af9f5b474a260ad23ffb9793d716a5e3bbce3b48, 262dcd809723723ed8a4e05437ec7e9c21a8f17e, eb4d7a946970469b3ab0c762432bf161d5b0836c, 8628f8ebf41669302513fb3f0bf0eba38b226742, b72dcfb9bf1f0f0147cda03dc59e4002a315067f, e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d, 9ff797e516dbc1ecb73701ec4c24055712d44411, 5.10.271, 5.15.222, 5.5, 5.20, 6.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.