SECUFOCUSNOW
Home›CVE index›CVE-2026-64009
Review reviewHigh

CVE-2026-64009

Linux

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrm_state_mtu Leo Lin reported OOB write issue in esp component: xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "header_len + authsize + net_adj" subtracted from a small "mtu" argument. A nobody user can install an IPv4 ESP tunnel SA with a large authentication key (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc), configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a large value. When a sin...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.20
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrm_state_mtu Leo Lin reported OOB write issue in esp component: xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "header_len + authsize + net_adj" subtracted from a small "mtu" argument. A nobody user can install an IPv4 ESP tunnel SA with a large authentication key (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key, 64-byte trunc), configure a small interface MTU (68 bytes), and set XFRMA_TFCPAD to a large value. When a sin...

Affected product and versions

Product
Linux
Affected versions
>= c5c2523893747f88a83376abad310c8ad13f7197 < 8014f70c4e6e5ab101ae3860a614e65e988372e3, >= c5c2523893747f88a83376abad310c8ad13f7197 < 1021d2877b689a648b27815c854557a917122e93, >= c5c2523893747f88a83376abad310c8ad13f7197 < 2a41b1b31c61c52b972278ce1732a1443f5e89ed, >= c5c2523893747f88a83376abad310c8ad13f7197 < fccd685b32df5aaf6bad4381eeda216468e283f0, >= c5c2523893747f88a83376abad310c8ad13f7197 < 820e501be8aee4b365d218d83227b314309c5fda, >= c5c2523893747f88a83376abad310c8ad13f7197 < 82ac903e0b519849647657b8c48d21237ada06a2, >= c5c2523893747f88a83376abad310c8ad13f7197 < 3db50ceeacb52806d8fe86fb1dfe944df0b9f789, >= c5c2523893747f88a83376abad310c8ad13f7197 < 742b04d0550b0ec89dcbc99537ec88653bd1ad90, >= 2.6.22
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available