CVE-2026-64114

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

ipv4: raw: reject IP_HDRINCL packets with ihl < 5

raw_send_hdrinc() validates that the caller-supplied IPv4 header

fits within the message length:

iphlen = iph->ihl * 4;

err = -EINVAL;

if (iphlen > length)

goto error_free;

if (iphlen >= sizeof(*iph)) {

/* fix up saddr, tot_len, id, csum, transport_header */

}

It does not, however, reject ihl < 5. For such a packet the

"if (iphlen >= sizeof(*iph))" branch is skipped, leaving the

crafted iphdr untouched, but the packet is still handed to

__ip_local_out() and onward. Downstream consumers that read

iph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in

particular subtracts sizeof(struct iphdr) from top_iph->ihl * 4

and passes the (signed-int-negative, then cast to size_t)

result to memcpy(), producing an OOB access of length close to

SIZE_MAX and a host kernel panic.

An IPv4 header with ihl < 5 is malformed by definition (RF

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References