SECUFOCUSNOW
Home›CVE index›CVE-2026-64114
Review reviewHigh

CVE-2026-64114

Linux

In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 raw_send_hdrinc() validates that the caller-supplied IPv4 header fits within the message length: iphlen = iph->ihl * 4; err = -EINVAL; if (iphlen > length) goto error_free; if (iphlen >= sizeof(*iph)) { /* fix up saddr, tot_len, id, csum, transport_header */ } It does not, however, reject ihl < 5. For such a packet the "if (iphlen >= sizeof(*iph))" branch is skipped, leaving the crafted iphdr untouched, but the packet is still handed to __ip_local_out() and onward. Downstrea...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.20
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 raw_send_hdrinc() validates that the caller-supplied IPv4 header fits within the message length: iphlen = iph->ihl * 4; err = -EINVAL; if (iphlen > length) goto error_free; if (iphlen >= sizeof(*iph)) { /* fix up saddr, tot_len, id, csum, transport_header */ } It does not, however, reject ihl < 5. For such a packet the "if (iphlen >= sizeof(*iph))" branch is skipped, leaving the crafted iphdr untouched, but the packet is still handed to __ip_local_out() and onward. Downstrea...

Affected product and versions

Product
Linux
Affected versions
>= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1065b9efa4126df559b03a849c139ecfae92cd25, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < bc20dbd48c26e743f7e0845020c11ed2ce8b15ee, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5a564f737ec54d63e8ee221d3ff396d07586d464, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 3c5411fa4944ed99af3d9d1de750ea8169b6dac9, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 145e9afa5b905229b4788bb72c3255f5a5f77508, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7725cd3b471740fd23d25ed1da722c671fb2a5d3, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < bbe0be67de296176e7243c76e3d9f02f6ae9ff0b, >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 915fab69823a14c170dbaa3b41978768e0fe62fc, >= 2.6.12
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available