CVE-2026-64268 (GCVE-0-2026-64268)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:52
VLAI
Title
RDMA/siw: bound Read Response placement to the RREAD length
Summary
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: bound Read Response placement to the RREAD length In drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each inbound Read Response DDP segment at sge->laddr + wqe->processed and then accumulates wqe->processed, but it never checks the running total against the sink buffer length on continuation segments. siw_check_sge() resolves and validates the sink memory only on the first fragment (the if (!*mem) branch), and siw_rresp_check_ntoh() compares the cumulative length against wqe->bytes only on the final segment (the !frx->more_ddp_segs guard). A connected siw peer that answers an outstanding RREAD with Read Response segments that keep the DDP Last flag clear, carrying more total payload than the RREAD requested, drives wqe->processed past the validated sink buffer; the next siw_rx_data() call writes out of bounds at sge->laddr + wqe->processed. siw runs iWARP over ordinary routable TCP, so the peer is the remote end of an established RDMA connection and needs no local privilege. Bound every segment before placement, exactly as siw_proc_send() and siw_proc_write() already do for their tagged and untagged paths, and terminate the connection with a base-or-bounds DDP error when the Read Response would overrun the sink buffer. This is the second receive-path length fix for this file. A separate change rejects an MPA FPDU length that underflows the per-fragment remainder in the header decode; that guard does not cover this case, because here each individual segment length is self-consistent and only the accumulated placement offset overruns the buffer.
Severity
9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < a31b6d18ded3cc32d9ee85a6ff0726d4274887b2 (git)
Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < 595e6537ad1a210da32cbb9a7f91aa73090915ba (git)
Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < 3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf (git)
Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < b2e26c955f8dd7e8d3f16c858db05245ea4fa817 (git)
Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < 6bc89f34a4597f9f6d41f7a60c67a3153bfe8851 (git)
Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < 423a78ff7928c2601013f73ec6d896f5597d0df5 (git)
Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < 75c93cd3c421890f49ea93f0b978b9b7bb10e5e3 (git)
Affected: 8b6a361b8c482f22ac99c3273285ff16b23fba91 , < 7d29f7e9dbd844cae4d3e559cf78324b9642fd6b (git)
guessed Create a notification for this product.
Linux Linux Affected: 5.3
Unaffected: 0 , < 5.3 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_qp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "a31b6d18ded3cc32d9ee85a6ff0726d4274887b2",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "595e6537ad1a210da32cbb9a7f91aa73090915ba",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "b2e26c955f8dd7e8d3f16c858db05245ea4fa817",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "6bc89f34a4597f9f6d41f7a60c67a3153bfe8851",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "423a78ff7928c2601013f73ec6d896f5597d0df5",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "75c93cd3c421890f49ea93f0b978b9b7bb10e5e3",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            },
            {
              "lessThan": "7d29f7e9dbd844cae4d3e559cf78324b9642fd6b",
              "status": "affected",
              "version": "8b6a361b8c482f22ac99c3273285ff16b23fba91",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/infiniband/sw/siw/siw_qp_rx.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "5.3"
            },
            {
              "lessThan": "5.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "5.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: bound Read Response placement to the RREAD length\n\nIn drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each\ninbound Read Response DDP segment at sge-\u003eladdr + wqe-\u003eprocessed and then\naccumulates wqe-\u003eprocessed, but it never checks the running total against\nthe sink buffer length on continuation segments. siw_check_sge() resolves\nand validates the sink memory only on the first fragment (the if (!*mem)\nbranch), and siw_rresp_check_ntoh() compares the cumulative length against\nwqe-\u003ebytes only on the final segment (the !frx-\u003emore_ddp_segs guard).\n\nA connected siw peer that answers an outstanding RREAD with Read Response\nsegments that keep the DDP Last flag clear, carrying more total payload\nthan the RREAD requested, drives wqe-\u003eprocessed past the validated sink\nbuffer; the next siw_rx_data() call writes out of bounds at\nsge-\u003eladdr + wqe-\u003eprocessed. siw runs iWARP over ordinary routable TCP,\nso the peer is the remote end of an established RDMA connection and needs\nno local privilege.\n\nBound every segment before placement, exactly as siw_proc_send() and\nsiw_proc_write() already do for their tagged and untagged paths, and\nterminate the connection with a base-or-bounds DDP error when the\nRead Response would overrun the sink buffer.\n\nThis is the second receive-path length fix for this file. A separate\nchange rejects an MPA FPDU length that underflows the per-fragment\nremainder in the header decode; that guard does not cover this case,\nbecause here each individual segment length is self-consistent and only\nthe accumulated placement offset overruns the buffer."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:N - siw carries iWARP over ordinary routable TCP, and the vulnerable receive callback processes crafted Read Response FPDUs from the remote endpoint of an established RDMA connection.\nAC:L - The peer learns the sink tag, address, and length from the RREAD and can deterministically send oversized continuation segments; no race or uncontrollable condition is required.\nPR:N - The MPA/siw data path performs no credential or capability check on the connected peer, and an unauthenticated RDMA service can accept the connection and issue attacker-induced RREADs.\nUI:N - The overflow is triggered through an automated RDMA protocol exchange and requires no human action.\nS:U - The corruption compromises resources within the affected host\u0027s kernel security authority and does not inherently cross a VM, IOMMU, or other security boundary.\nC:H - The global DMA/KVA sink case exposes the sink address and permits attacker-controlled kernel memory corruption, which can enable control-flow hijacking and arbitrary kernel-memory disclosure.\nI:H - Attacker-chosen response bytes are written beyond the validated sink into adjacent kernel memory, providing an exploitable out-of-bounds write capable of modifying objects or achieving kernel code execution.\nA:H - The overwrite can corrupt critical kernel objects or reach invalid memory, causing an oops or panic; bounded FRWR sinks still permit connection-terminating denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:52:22.293Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/a31b6d18ded3cc32d9ee85a6ff0726d4274887b2"
        },
        {
          "url": "https://git.kernel.org/stable/c/595e6537ad1a210da32cbb9a7f91aa73090915ba"
        },
        {
          "url": "https://git.kernel.org/stable/c/3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2e26c955f8dd7e8d3f16c858db05245ea4fa817"
        },
        {
          "url": "https://git.kernel.org/stable/c/6bc89f34a4597f9f6d41f7a60c67a3153bfe8851"
        },
        {
          "url": "https://git.kernel.org/stable/c/423a78ff7928c2601013f73ec6d896f5597d0df5"
        },
        {
          "url": "https://git.kernel.org/stable/c/75c93cd3c421890f49ea93f0b978b9b7bb10e5e3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b"
        }
      ],
      "title": "RDMA/siw: bound Read Response placement to the RREAD length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64268",
    "datePublished": "2026-07-25T08:49:16.336Z",
    "dateReserved": "2026-07-19T15:36:31.775Z",
    "dateUpdated": "2026-08-17T04:52:22.293Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64268",
      "date": "2026-08-17",
      "epss": "0.00695",
      "percentile": "0.49943"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:49:39.000Z",
      "cve": "CVE-2026-64268",
      "id": "msrc_CVE-2026-64268",
      "initial_release_date": "2026-07-26T01:07:33.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "RDMA/siw: bound Read Response placement to the RREAD length",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64268.json",
      "version": "2"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-64268\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2026-07-25T10:17:07.013\",\"lastModified\":\"2026-08-17T05:17:25.653\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nRDMA/siw: bound Read Response placement to the RREAD length\\n\\nIn drivers/infiniband/sw/siw/siw_qp_rx.c, siw_proc_rresp() places each\\ninbound Read Response DDP segment at sge-\u003eladdr + wqe-\u003eprocessed and then\\naccumulates wqe-\u003eprocessed, but it never checks the running total against\\nthe sink buffer length on continuation segments. siw_check_sge() resolves\\nand validates the sink memory only on the first fragment (the if (!*mem)\\nbranch), and siw_rresp_check_ntoh() compares the cumulative length against\\nwqe-\u003ebytes only on the final segment (the !frx-\u003emore_ddp_segs guard).\\n\\nA connected siw peer that answers an outstanding RREAD with Read Response\\nsegments that keep the DDP Last flag clear, carrying more total payload\\nthan the RREAD requested, drives wqe-\u003eprocessed past the validated sink\\nbuffer; the next siw_rx_data() call writes out of bounds at\\nsge-\u003eladdr + wqe-\u003eprocessed. siw runs iWARP over ordinary routable TCP,\\nso the peer is the remote end of an established RDMA connection and needs\\nno local privilege.\\n\\nBound every segment before placement, exactly as siw_proc_send() and\\nsiw_proc_write() already do for their tagged and untagged paths, and\\nterminate the connection with a base-or-bounds DDP error when the\\nRead Response would overrun the sink buffer.\\n\\nThis is the second receive-path length fix for this file. A separate\\nchange rejects an MPA FPDU length that underflows the per-fragment\\nremainder in the header decode; that guard does not cover this case,\\nbecause here each individual segment length is self-consistent and only\\nthe accumulated placement offset overruns the buffer.\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"drivers/infiniband/sw/siw/siw_qp_rx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"a31b6d18ded3cc32d9ee85a6ff0726d4274887b2\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"595e6537ad1a210da32cbb9a7f91aa73090915ba\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"b2e26c955f8dd7e8d3f16c858db05245ea4fa817\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"6bc89f34a4597f9f6d41f7a60c67a3153bfe8851\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"423a78ff7928c2601013f73ec6d896f5597d0df5\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"75c93cd3c421890f49ea93f0b978b9b7bb10e5e3\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"8b6a361b8c482f22ac99c3273285ff16b23fba91\",\"lessThan\":\"7d29f7e9dbd844cae4d3e559cf78324b9642fd6b\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"drivers/infiniband/sw/siw/siw_qp_rx.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"5.3\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"5.3\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.261\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.212\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.1.178\",\"lessThanOrEqual\":\"6.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.6.145\",\"lessThanOrEqual\":\"6.6.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.12.96\",\"lessThanOrEqual\":\"6.12.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.18.39\",\"lessThanOrEqual\":\"6.18.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.1.4\",\"lessThanOrEqual\":\"7.1.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"7.2\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":9.8,\"baseSeverity\":\"CRITICAL\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":5.9}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-787\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.3\",\"versionEndExcluding\":\"5.10.261\",\"matchCriteriaId\":\"4E80D5DC-1315-4457-8A33-9F3C37EA4F5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.212\",\"matchCriteriaId\":\"8E99FB01-CD93-41AF-A653-3F450652B9A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"6.1.178\",\"matchCriteriaId\":\"092233C7-F4E0-40C8-BD4D-A28FE50DFE20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.2\",\"versionEndExcluding\":\"6.6.145\",\"matchCriteriaId\":\"7046B092-F810-4440-ACE6-60218518EECE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.7\",\"versionEndExcluding\":\"6.12.96\",\"matchCriteriaId\":\"38A8100E-2B1A-462F-AEE9-8901B870FEF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.13\",\"versionEndExcluding\":\"6.18.39\",\"matchCriteriaId\":\"914AE4BC-3D59-4C5A-9DB5-9CE327B429F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"6.19\",\"versionEndExcluding\":\"7.1.4\",\"matchCriteriaId\":\"6228DDD6-4557-4AA3-9F43-AB995D471E42\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/3ef7e052cbd05a8b13a51a07b185a39ec93ee1cf\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/423a78ff7928c2601013f73ec6d896f5597d0df5\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/595e6537ad1a210da32cbb9a7f91aa73090915ba\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/6bc89f34a4597f9f6d41f7a60c67a3153bfe8851\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/75c93cd3c421890f49ea93f0b978b9b7bb10e5e3\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/7d29f7e9dbd844cae4d3e559cf78324b9642fd6b\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/a31b6d18ded3cc32d9ee85a6ff0726d4274887b2\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/b2e26c955f8dd7e8d3f16c858db05245ea4fa817\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Important",
      "current_release_date": "2026-08-13T16:37:01+00:00",
      "cve": "CVE-2026-64268",
      "id": "CVE-2026-64268",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_affected": "156",
      "product_status:known_not_affected": "118",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: Kernel: Remote out-of-bounds write in RDMA/siw",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64268.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "critical",
      "current_release_date": "2026-08-03T17:14:34Z",
      "cve": "CVE-2026-64268",
      "id": "CVE-2026-64268",
      "initial_release_date": "2026-07-25T16:46:57Z",
      "product_status:known_affected": "245",
      "product_status:known_not_affected": "53",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64268",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64268.json",
      "version": "4"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.