CVE-2026-64102

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Reject MPA FPDU length underflow before signed receive math

A malicious connected siw peer can send an iWARP FPDU whose MPA length

field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller

than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP

parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode]

.hdr_len, but never compares mpa_len against that header length.

siw_tcp_rx_data() then derives

srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd

+ MPA_HDR_SIZE;

where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this

point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest

on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below

hdr_len - MPA_HDR_SIZE underflows to a negative int.

The signed value then flows into siw_proc_write()/siw_proc_rresp() as

bytes = min(srx->fpdu_part_rem, srx->skb_n

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References