CVE-2026-64414: netfilter: handle unreadable frags
In the Linux kernel, the following vulnerability has been resolved:
netfilter: handle unreadable frags
sashiko reports: When an skb with unreadable fragments (such as from devmem TCP, where skbfragsreadable(skb) returns false) is processed by the u32 module, skbcopybits() will safely return a negative error code [..]
xtu32: bail out with hotdrop in this case. gatherfrags: return -1, just as if we had no fragment header. nfnetlinkqueue: restrict to the linear part. nfnetlinklog: restrict to the linear part.
v2: - skbzerocopy helpers don't copy readable flag, i.e. nfnetlinkqueue is broken too xtu32 shouldn't return true if hotdrop was set.
Affected Software
Remediation
Event History
Frequently Asked Questions
What conditions are required to trigger the denial of service?
An attacker must be able to send network traffic that results in an skb with unreadable fragments being processed by affected netfilter components. The issue is associated with cases such as devmem TCP and processing by the u32 module; the CVSS vector indicates network access, no privileges, and no user interaction are required.
Are systems using default configurations necessarily affected?
The available information does not establish whether the relevant netfilter paths, u32 rules, or unreadable-fragment conditions are present in a default configuration. Exposure depends on whether affected packet-processing paths can receive such skb fragments.
What can be done before the patch is deployed?
No specific workaround is provided. Prioritize limiting untrusted network traffic to systems where netfilter u32 processing or nfnetlink queue/log handling may process unreadable fragments, then apply the available patch.
How can an operator determine whether this issue may apply to a system?
Review whether the system uses the Linux kernel netfilter subsystem, particularly xt_u32 rules or nfnetlink queue/log processing. Systems that can process packets with unreadable fragments, including devmem TCP-related cases, warrant prioritization.