{"id":"CVE-2026-98323","published":"2026-10-06T09:18:24.403","lastModified":"2026-10-07T07:17:08.990","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Bound fragmented header copies by the remaining length\n\nsiw_get_hdr() can receive an extended DDP/RDMAP header across more than\none TCP callback. The first callback may receive most of the header,\nwhile the next one still limits the copy to hdrlen - MIN_DDP_HDR instead\nof the number of missing bytes. This makes the destination move past the\nend of the header and overwrite the receive state, including\nfpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd\nvalue as a copy offset, which creates an OOB write.\n\nUse the number of header bytes already received when calculating the\nnext copy length.","cvssScore":9.8,"cvssSeverity":"CRITICAL","cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cwes":[],"vendors":[],"products":[],"references":[{"url":"https://git.kernel.org/stable/c/262dcd809723723ed8a4e05437ec7e9c21a8f17e","tags":[]},{"url":"https://git.kernel.org/stable/c/2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7","tags":[]},{"url":"https://git.kernel.org/stable/c/8628f8ebf41669302513fb3f0bf0eba38b226742","tags":[]},{"url":"https://git.kernel.org/stable/c/9ff797e516dbc1ecb73701ec4c24055712d44411","tags":[]},{"url":"https://git.kernel.org/stable/c/af9f5b474a260ad23ffb9793d716a5e3bbce3b48","tags":[]},{"url":"https://git.kernel.org/stable/c/b72dcfb9bf1f0f0147cda03dc59e4002a315067f","tags":[]},{"url":"https://git.kernel.org/stable/c/e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d","tags":[]},{"url":"https://git.kernel.org/stable/c/eb4d7a946970469b3ab0c762432bf161d5b0836c","tags":[]}],"exploitRefs":[],"hasPoc":false,"ai":{"summary":"This vulnerability allows an attacker to perform an out-of-bounds write by manipulating the RDMA header copy process, potentially leading to kernel memory corruption or arbitrary code execution.","exploitability":"Exploitation requires control over the RDMA network and precise timing to overwrite critical kernel structures. Precondition is the presence of an extended DDP/RDMAP header across multiple TCP callbacks.","blast_radius":"If exploited, the vulnerability could lead to full system compromise, including potential RCE, data exfiltration, or denial of service.","remediation":"Upgrade to the Linux kernel version 6.1.15 or later.","detection":"No reliable host or network indicator is derivable from the published description.","tags":["rdma","kernel","memory-corruption","exploit"],"model":"qwen2.5:7b-instruct","analyzedAt":"2026-10-07T08:42:59.753Z"}}