CVE-2026-98323

Full vulnerability record from the local CVENow database.

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length.

Severity

CRITICAL

CVSS score

9.8 (v3.1)

Vulnerability status

Received

Source identifier

416baaa9-dc9f-4396-8d5f-8c081fb06d67

Published

2026-10-06 09:18:24.403000

Last modified

2026-10-19 10:18:34.457000

View original CVE JSON

{
  "id": "CVE-2026-98323",
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "published": "2026-10-06T09:18:24.403",
  "lastModified": "2026-10-19T10:18:34.457",
  "vulnStatus": "Received",
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Bound fragmented header copies by the remaining length\n\nsiw_get_hdr() can receive an extended DDP/RDMAP header across more than\none TCP callback. The first callback may receive most of the header,\nwhile the next one still limits the copy to hdrlen - MIN_DDP_HDR instead\nof the number of missing bytes. This makes the destination move past the\nend of the header and overwrite the receive state, including\nfpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd\nvalue as a copy offset, which creates an OOB write.\n\nUse the number of header bytes already received when calculating the\nnext copy length."
    }
  ],
  "affected": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "affectedData": [
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "unaffected",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_qp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "e3917c85f41ef1df64e27dc0e46ab0d803c5e73e",
              "lessThan": "2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "308cd50f174c95a507527037f4de1a0396aa4325",
              "lessThan": "af9f5b474a260ad23ffb9793d716a5e3bbce3b48",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "754209850df8367c954ac1de7671c7430b1f342c",
              "lessThan": "262dcd809723723ed8a4e05437ec7e9c21a8f17e",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "754209850df8367c954ac1de7671c7430b1f342c",
              "lessThan": "eb4d7a946970469b3ab0c762432bf161d5b0836c",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "754209850df8367c954ac1de7671c7430b1f342c",
              "lessThan": "8628f8ebf41669302513fb3f0bf0eba38b226742",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "754209850df8367c954ac1de7671c7430b1f342c",
              "lessThan": "b72dcfb9bf1f0f0147cda03dc59e4002a315067f",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "754209850df8367c954ac1de7671c7430b1f342c",
              "lessThan": "e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "754209850df8367c954ac1de7671c7430b1f342c",
              "lessThan": "9ff797e516dbc1ecb73701ec4c24055712d44411",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "e09caa38e10bcf027100cc22b0e3cc745a39ef0a",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "0c14f795a9eab9344230f9933798b8ee496f497d",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "7fada7c6962219b6fc4ff4e62e46a936af110dd9",
              "versionType": "git",
              "status": "affected"
            },
            {
              "version": "5.10.150",
              "lessThan": "5.10.271",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.15.75",
              "lessThan": "5.15.222",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.4.220",
              "lessThan": "5.5",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "5.19.17",
              "lessThan": "5.20",
              "versionType": "semver",
              "status": "affected"
            },
            {
              "version": "6.0.3",
              "lessThan": "6.1",
              "versionType": "semver",
              "status": "affected"
            }
          ]
        },
        {
          "vendor": "Linux",
          "product": "Linux",
          "defaultStatus": "affected",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_qp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "versions": [
            {
              "version": "6.1",
              "status": "affected"
            },
            {
              "version": "0",
              "lessThan": "6.1",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.10.271",
              "lessThanOrEqual": "5.10.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "5.15.222",
              "lessThanOrEqual": "5.15.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.1.189",
              "lessThanOrEqual": "6.1.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.6.158",
              "lessThanOrEqual": "6.6.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.12.112",
              "lessThanOrEqual": "6.12.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "6.18.54",
              "lessThanOrEqual": "6.18.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.2.8",
              "lessThanOrEqual": "7.2.*",
              "versionType": "semver",
              "status": "unaffected"
            },
            {
              "version": "7.3",
              "lessThanOrEqual": "*",
              "versionType": "original_commit_for_fix",
              "status": "unaffected"
            }
          ]
        }
      ]
    }
  ],
  "metrics": {
    "cvssMetricV31": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "type": "Secondary",
        "cvssData": {
          "version": "3.1",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
          "baseScore": 9.8,
          "baseSeverity": "CRITICAL",
          "attackVector": "NETWORK",
          "attackComplexity": "LOW",
          "privilegesRequired": "NONE",
          "userInteraction": "NONE",
          "scope": "UNCHANGED",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "availabilityImpact": "HIGH"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 5.9
      }
    ]
  },
  "references": [
    {
      "url": "https://git.kernel.org/stable/c/262dcd809723723ed8a4e05437ec7e9c21a8f17e",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/8628f8ebf41669302513fb3f0bf0eba38b226742",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/9ff797e516dbc1ecb73701ec4c24055712d44411",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/af9f5b474a260ad23ffb9793d716a5e3bbce3b48",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/b72dcfb9bf1f0f0147cda03dc59e4002a315067f",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    },
    {
      "url": "https://git.kernel.org/stable/c/eb4d7a946970469b3ab0c762432bf161d5b0836c",
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ]
}