Review reviewHigh

CVE-2026-64414

Linux

In the Linux kernel, the following vulnerability has been resolved: netfilter: handle unreadable frags sashiko reports: When an skb with unreadable fragments (such as from devmem TCP, where skb_frags_readable(skb) returns false) is processed by the u32 module, skb_copy_bits() will safely return a negative error code [..] xt_u32: bail out with hotdrop in this case. gather_frags: return -1, just as if we had no fragment header. nfnetlink_queue: restrict to the linear part. nfnetlink_log: restrict to the linear part. v2: - skb_zerocopy helpers don't copy readable flag, i.e. nfnetlink_queue is...

CVSS: 7.5
EPSS: -
CISA KEV: Not listed
Published: 2026.07.25

PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV

Exploit probability-

Technical severityCVSS 7.5

Vulnerability overview

Affected product and versions

Product: Linux
Affected versions: >= 65249feb6b3df9e17bab5911ee56fa7b0971e231 < 3b13e7635795394705920cca1e1db7e4ca2e334b, >= 65249feb6b3df9e17bab5911ee56fa7b0971e231 < fc5bfe63bacf8a3ae307b62b34206406ca733354, >= 65249feb6b3df9e17bab5911ee56fa7b0971e231 < 57056be3ec12e7d9ecd20a60d4060f510e4f284c, >= 65249feb6b3df9e17bab5911ee56fa7b0971e231 < da5b58478a9c1b85608c9e40a3b8432d071b409e, >= 6.12
Fixed versions: No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide

1
Identify
Confirm that Linux and an affected version are present.
2
Prioritize
Combine exploitation signals with asset exposure and business criticality.
3
Remediate
Follow the vendor advisory or supported update path and preserve rollback options.
4
Verify
Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE: Not available