{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-98323", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-09-25T10:25:14.340Z", "datePublished": "2026-10-06T08:46:17.150Z", "dateUpdated": "2026-10-19T09:17:33.779Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-10-19T09:17:33.779Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Bound fragmented header copies by the remaining length\n\nsiw_get_hdr() can receive an extended DDP/RDMAP header across more than\none TCP callback. The first callback may receive most of the header,\nwhile the next one still limits the copy to hdrlen - MIN_DDP_HDR instead\nof the number of missing bytes. This makes the destination move past the\nend of the header and overwrite the receive state, including\nfpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd\nvalue as a copy offset, which creates an OOB write.\n\nUse the number of header bytes already received when calculating the\nnext copy length."}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "baseScore": 9.8, "baseSeverity": "CRITICAL"}, "scenarios": [{"lang": "en", "value": "AV:N - The malformed input is the remote iWARP peer's own MPA/DDP/RDMAP header bytes on the siw TCP connection. The peer splits an extended header (e.g. RDMA Read Request, 44 bytes) across TCP segments, and siw_qp_llp_data_ready() -> tcp_read_sock() -> siw_tcp_rx_data() -> siw_get_hdr() parses them. The transport is routable TCP.\nAC:L - The peer fully controls TCP segmentation, so it can deterministically end a segment with fpdu_part_rcvd between 16 and hdrlen. The next segment then copies hdrlen-16 bytes at that offset. No race or state outside the attacker's control is involved beyond siw serving an iWARP listener.\nPR:N - Once the MPA exchange puts the QP in RTS, siw_get_hdr() parses every incoming FPDU header, and neither MPA nor DDP authenticates the peer. ULP authorisation (such as an nvmet-rdma host NQN check) only arrives in messages parsed by this same path, so the overflow fires before any credential check.\nUI:N - No victim action is needed. The attacker connects to the iWARP service and sends crafted fragmented FPDUs, and siw processes them in its sk_data_ready callback.\nS:U - The corruption is confined to kernel memory of the host running siw (struct siw_qp and its neighbours). That is the same security authority as the vulnerable component, with no VM or IOMMU boundary crossed.\nC:H - The overflow writes peer bytes over siw_rx_stream fields after hdr, including fpdu_part_rcvd. A negative fpdu_part_rcvd then makes skb_copy_bits() write to c_hdr plus an attacker-chosen offset. A controlled kernel write like this can be turned into arbitrary kernel memory disclosure.\nI:H - siw_get_hdr() copies up to hdrlen-17 attacker bytes past srx->hdr (27 for rreq), overwriting the receive state. The next callback uses the corrupted negative fpdu_part_rcvd as the destination offset of skb_copy_bits(), giving an out-of-bounds kernel write whose offset and data are attacker-controlled.\nA:H - Corrupting fpdu_part_rcvd/fpdu_part_rem and writing out of bounds from siw_qp crashes or panics the kernel. A remote peer can repeat this on every connection."}]}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/siw/siw_qp_rx.c"], "versions": [{"version": "e3917c85f41ef1df64e27dc0e46ab0d803c5e73e", "lessThan": "2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7", "status": "affected", "versionType": "git"}, {"version": "308cd50f174c95a507527037f4de1a0396aa4325", "lessThan": "af9f5b474a260ad23ffb9793d716a5e3bbce3b48", "status": "affected", "versionType": "git"}, {"version": "754209850df8367c954ac1de7671c7430b1f342c", "lessThan": "262dcd809723723ed8a4e05437ec7e9c21a8f17e", "status": "affected", "versionType": "git"}, {"version": "754209850df8367c954ac1de7671c7430b1f342c", "lessThan": "eb4d7a946970469b3ab0c762432bf161d5b0836c", "status": "affected", "versionType": "git"}, {"version": "754209850df8367c954ac1de7671c7430b1f342c", "lessThan": "8628f8ebf41669302513fb3f0bf0eba38b226742", "status": "affected", "versionType": "git"}, {"version": "754209850df8367c954ac1de7671c7430b1f342c", "lessThan": "b72dcfb9bf1f0f0147cda03dc59e4002a315067f", "status": "affected", "versionType": "git"}, {"version": "754209850df8367c954ac1de7671c7430b1f342c", "lessThan": "e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d", "status": "affected", "versionType": "git"}, {"version": "754209850df8367c954ac1de7671c7430b1f342c", "lessThan": "9ff797e516dbc1ecb73701ec4c24055712d44411", "status": "affected", "versionType": "git"}, {"version": "e09caa38e10bcf027100cc22b0e3cc745a39ef0a", "status": "affected", "versionType": "git"}, {"version": "0c14f795a9eab9344230f9933798b8ee496f497d", "status": "affected", "versionType": "git"}, {"version": "7fada7c6962219b6fc4ff4e62e46a936af110dd9", "status": "affected", "versionType": "git"}, {"version": "5.10.150", "lessThan": "5.10.271", "status": "affected", "versionType": "semver"}, {"version": "5.15.75", "lessThan": "5.15.222", "status": "affected", "versionType": "semver"}, {"version": "5.4.220", "lessThan": "5.5", "status": "affected", "versionType": "semver"}, {"version": "5.19.17", "lessThan": "5.20", "status": "affected", "versionType": "semver"}, {"version": "6.0.3", "lessThan": "6.1", "status": "affected", "versionType": "semver"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/infiniband/sw/siw/siw_qp_rx.c"], "versions": [{"version": "6.1", "status": "affected"}, {"version": "0", "lessThan": "6.1", "status": "unaffected", "versionType": "semver"}, {"version": "5.10.271", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.222", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.189", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.158", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.112", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.54", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.2.8", "lessThanOrEqual": "7.2.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.3", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.10.150", "versionEndExcluding": "5.10.271"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.15.75", "versionEndExcluding": "5.15.222"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.1.189"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.6.158"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.12.112"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "6.18.54"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.2.8"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.1", "versionEndExcluding": "7.3"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.4.220"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.19.17"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "6.0.3"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7"}, {"url": "https://git.kernel.org/stable/c/af9f5b474a260ad23ffb9793d716a5e3bbce3b48"}, {"url": "https://git.kernel.org/stable/c/262dcd809723723ed8a4e05437ec7e9c21a8f17e"}, {"url": "https://git.kernel.org/stable/c/eb4d7a946970469b3ab0c762432bf161d5b0836c"}, {"url": "https://git.kernel.org/stable/c/8628f8ebf41669302513fb3f0bf0eba38b226742"}, {"url": "https://git.kernel.org/stable/c/b72dcfb9bf1f0f0147cda03dc59e4002a315067f"}, {"url": "https://git.kernel.org/stable/c/e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d"}, {"url": "https://git.kernel.org/stable/c/9ff797e516dbc1ecb73701ec4c24055712d44411"}], "title": "RDMA/siw: Bound fragmented header copies by the remaining length", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/infiniband/sw/siw/siw_qp_rx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7", "status": "affected", "version": "e3917c85f41ef1df64e27dc0e46ab0d803c5e73e", "versionType": "git"}, {"lessThan": "af9f5b474a260ad23ffb9793d716a5e3bbce3b48", "status": "affected", "version": "308cd50f174c95a507527037f4de1a0396aa4325", "versionType": "git"}, {"lessThan": "262dcd809723723ed8a4e05437ec7e9c21a8f17e", "status": "affected", "version": "754209850df8367c954ac1de7671c7430b1f342c", "versionType": "git"}, {"lessThan": "eb4d7a946970469b3ab0c762432bf161d5b0836c", "status": "affected", "version": "754209850df8367c954ac1de7671c7430b1f342c", "versionType": "git"}, {"lessThan": "8628f8ebf41669302513fb3f0bf0eba38b226742", "status": "affected", "version": "754209850df8367c954ac1de7671c7430b1f342c", "versionType": "git"}, {"lessThan": "b72dcfb9bf1f0f0147cda03dc59e4002a315067f", "status": "affected", "version": "754209850df8367c954ac1de7671c7430b1f342c", "versionType": "git"}, {"lessThan": "e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d", "status": "affected", "version": "754209850df8367c954ac1de7671c7430b1f342c", "versionType": "git"}, {"lessThan": "9ff797e516dbc1ecb73701ec4c24055712d44411", "status": "affected", "version": "754209850df8367c954ac1de7671c7430b1f342c", "versionType": "git"}, {"status": "affected", "version": "e09caa38e10bcf027100cc22b0e3cc745a39ef0a", "versionType": "git"}, {"status": "affected", "version": "0c14f795a9eab9344230f9933798b8ee496f497d", "versionType": "git"}, {"status": "affected", "version": "7fada7c6962219b6fc4ff4e62e46a936af110dd9", "versionType": "git"}, {"lessThan": "5.10.271", "status": "affected", "version": "5.10.150", "versionType": "semver"}, {"lessThan": "5.15.222", "status": "affected", "version": "5.15.75", "versionType": "semver"}, {"lessThan": "5.5", "status": "affected", "version": "5.4.220", "versionType": "semver"}, {"lessThan": "5.20", "status": "affected", "version": "5.19.17", "versionType": "semver"}, {"lessThan": "6.1", "status": "affected", "version": "6.0.3", "versionType": "semver"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/infiniband/sw/siw/siw_qp_rx.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "6.1"}, {"lessThan": "6.1", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.10.*", "status": "unaffected", "version": "5.10.271", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.222", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.189", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.158", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.112", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.54", "versionType": "semver"}, {"lessThanOrEqual": "7.2.*", "status": "unaffected", "version": "7.2.8", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.3", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Bound fragmented header copies by the remaining length\n\nsiw_get_hdr() can receive an extended DDP/RDMAP header across more than\none TCP callback. The first callback may receive most of the header,\nwhile the next one still limits the copy to hdrlen - MIN_DDP_HDR instead\nof the number of missing bytes. This makes the destination move past the\nend of the header and overwrite the receive state, including\nfpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd\nvalue as a copy offset, which creates an OOB write.\n\nUse the number of header bytes already received when calculating the\nnext copy length."}], "id": "CVE-2026-98323", "lastModified": "2026-10-19T10:18:34.457", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "type": "Secondary"}]}, "published": "2026-10-06T09:18:24.403", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/262dcd809723723ed8a4e05437ec7e9c21a8f17e"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/8628f8ebf41669302513fb3f0bf0eba38b226742"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/9ff797e516dbc1ecb73701ec4c24055712d44411"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/af9f5b474a260ad23ffb9793d716a5e3bbce3b48"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/b72dcfb9bf1f0f0147cda03dc59e4002a315067f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/eb4d7a946970469b3ab0c762432bf161d5b0836c"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Received"}

{"bugzilla": {"description": "kernel: RDMA/siw: Bound fragmented header copies by the remaining length", "id": "2546392", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2546392"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-787", "details": ["In the Linux kernel, the following vulnerability has been resolved:\nRDMA/siw: Bound fragmented header copies by the remaining length\nsiw_get_hdr() can receive an extended DDP/RDMAP header across more than\none TCP callback. The first callback may receive most of the header,\nwhile the next one still limits the copy to hdrlen - MIN_DDP_HDR instead\nof the number of missing bytes. This makes the destination move past the\nend of the header and overwrite the receive state, including\nfpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd\nvalue as a copy offset, which creates an OOB write.\nUse the number of header bytes already received when calculating the\nnext copy length.", "A flaw was found in the Linux kernel's Software iWARP (siw) Remote Direct Memory Access (RDMA) driver. When handling extended protocol headers split across multiple network packets, the driver incorrectly calculates the remaining length during the copy operation, leading to an out-of-bounds memory write. A remote attacker could exploit this vulnerability by sending fragmented network traffic, potentially resulting in memory corruption and a Denial of Service (DoS)."], "name": "CVE-2026-98323", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Not affected", "package_name": "openshift/ose-rhel-coreos-8", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "openshift/ose-rhel-coreos-9", "product_name": "Red Hat OpenShift Container Platform 4"}], "public_date": "2026-10-06T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-98323\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-98323\nhttps://git.kernel.org/pub/scm/linux/security/vulns.git/plain/cve/published/2026/CVE-2026-98323.mbox"], "threat_severity": "Important"}