Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-64009

In the Linux kernel, the following vulnerability has been resolved: xfrm: Check for underflow in xfrm_state_mtu Leo Lin reported OOB write issue in esp component: xfrm_state_mtu() returns u32 but performs its arithmetic in unsigned modulo-2^32 space using an attacker-influenced "header_len + authsize + net_adj" subtracted from a small "mtu" argument. A nobody user can install an IPv4 ESP tunnel SA with a large authentication key (XFRMA_ALG_AUTH_TRUNC, e.g. hmac(sha512), 64-byte key,
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:0d7eddf404c8f86481a132d6dcddcd0e2fa28908a931472c5f84895367db3432
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_state.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.22"},{"lessThan":"2.6.22","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"les…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5979ff5c3f77357c311101194d26c268b2f80787209f9776b2c61c662d172b41 · sha256:031a990070108698… · /containers/cna/affected/1

{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_state.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8014f70c4e6e5ab101ae3860a614e65e988372e3","status":"affected","version":"c5c2523893747f88a83376abad310c8ad13f7197","versionType":"git"},{"lessThan":"1021d2877b689a648b27815c854557a917122e93","status":"affected","version":"c5c2523893747f88a83376abad310c8ad13f7197","versionType":"git"},{"lessThan":"2a41b1b31c61c52b972278ce1732a1443f5e89ed","status":"affected","version":"c5c2523893747f88a83376ab…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5979ff5c3f77357c311101194d26c268b2f80787209f9776b2c61c662d172b41 · sha256:031a990070108698… · /containers/cna/affected/0

Affected products and versions

2 source assertions
{"defaultStatus":"affected","product":"Linux","programFiles":["net/xfrm/xfrm_state.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.22"},{"lessThan":"2.6.22","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.259","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"les…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5979ff5c3f77357c311101194d26c268b2f80787209f9776b2c61c662d172b41 · sha256:031a990070108698… · /containers/cna/affected/1
{"defaultStatus":"unaffected","product":"Linux","programFiles":["net/xfrm/xfrm_state.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"8014f70c4e6e5ab101ae3860a614e65e988372e3","status":"affected","version":"c5c2523893747f88a83376abad310c8ad13f7197","versionType":"git"},{"lessThan":"1021d2877b689a648b27815c854557a917122e93","status":"affected","version":"c5c2523893747f88a83376abad310c8ad13f7197","versionType":"git"},{"lessThan":"2a41b1b31c61c52b972278ce1732a1443f5e89ed","status":"affected","version":"c5c2523893747f88a83376ab…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:5979ff5c3f77357c311101194d26c268b2f80787209f9776b2c61c662d172b41 · sha256:031a990070108698… · /containers/cna/affected/0

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:5979ff5c3f77357c311101194d26c268b2f80787209f9776b2c61c662d172b41 · sha256:031a990070108698… · /containers/cna/metrics/0/cvssV3_1

Source references

8 source assertions
{"url":"https://git.kernel.org/stable/c/1021d2877b689a648b27815c854557a917122e93"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5979ff5c3f77357c311101194d26c268b2f80787209f9776b2c61c662d172b41 · sha256:031a990070108698… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/2a41b1b31c61c52b972278ce1732a1443f5e89ed"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5979ff5c3f77357c311101194d26c268b2f80787209f9776b2c61c662d172b41 · sha256:031a990070108698… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/3db50ceeacb52806d8fe86fb1dfe944df0b9f789"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5979ff5c3f77357c311101194d26c268b2f80787209f9776b2c61c662d172b41 · sha256:031a990070108698… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/742b04d0550b0ec89dcbc99537ec88653bd1ad90"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5979ff5c3f77357c311101194d26c268b2f80787209f9776b2c61c662d172b41 · sha256:031a990070108698… · /containers/cna/references/7
{"url":"https://git.kernel.org/stable/c/8014f70c4e6e5ab101ae3860a614e65e988372e3"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5979ff5c3f77357c311101194d26c268b2f80787209f9776b2c61c662d172b41 · sha256:031a990070108698… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/820e501be8aee4b365d218d83227b314309c5fda"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5979ff5c3f77357c311101194d26c268b2f80787209f9776b2c61c662d172b41 · sha256:031a990070108698… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/82ac903e0b519849647657b8c48d21237ada06a2"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5979ff5c3f77357c311101194d26c268b2f80787209f9776b2c61c662d172b41 · sha256:031a990070108698… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/fccd685b32df5aaf6bad4381eeda216468e283f0"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:5979ff5c3f77357c311101194d26c268b2f80787209f9776b2c61c662d172b41 · sha256:031a990070108698… · /containers/cna/references/3

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer