CVE-2026-98323
Critical · 9.8CVSS
9.8
EPSS
0.6%
Published
Oct 6, 2026
CISA due date
—
Cloudanix analysis
A flaw in how the Linux kernel handles certain network messages for high-speed networking can let an attacker send specially crafted data that overwrites memory and potentially takes over the machine.
- Exploitation
- Remote Unauthenticated
- Attacker needs
- None
- Complexity
- Low
- Impact
- Full Compromise
- Component
- OS kernel
- Class
- Buffer Overflow
- Remediation
- Upgrade
- Effort
- Medium
- Patch risk
- Low
What it actually does
Incorrect copy length calculation in siw_get_hdr() when an extended DDP/RDMAP header arrives across multiple TCP callbacks allows the destination pointer to advance past the end of the receive buffer, corrupting fpdu_part_rcvd and enabling an out-of-bounds write on a subsequent callback.
Why it matters to the business
Systems using RDMA over TCP (SIW) can be remotely compromised, leading to kernel-level code execution, service disruption, or full host takeover; urgency is moderate given low EPSS and lack of known exploitation 17 days after disclosure.
How an attack unfolds
An attacker establishes a TCP connection to a vulnerable SIW endpoint and sends a fragmented extended header such that the first segment fills most of the header while the second segment's copy length is computed from the original hdrlen rather than remaining bytes; this produces a negative fpdu_part_rcvd value used as a write offset, resulting in an OOB memory write that can be shaped for arbitrary kernel memory corruption.
How to fix it
Apply the upstream kernel commit that bounds the copy length by the number of header bytes still missing; rebuild and deploy the fixed kernel on all systems exposing RDMA/siw interfaces; until patched, restrict SIW listener exposure to trusted networks.
How to confirm the fix worked
Confirm the fix by inspecting the siw_get_hdr() implementation to ensure copy length is calculated from already-received header bytes; test with crafted multi-callback header fragments in a lab environment and verify no OOB write occurs; scan running kernels for the vulnerable code pattern via source or binary analysis.
Typical attack path
- Establish TCP connection to target SIW listener
- Transmit first fragment containing most of an extended DDP/RDMAP header
- Transmit second fragment sized to trigger miscalculated copy length
- Trigger subsequent callback that uses negative offset for write
- Leverage resulting OOB write for kernel code execution or denial of service
How to detect it
Review kernel logs and network traces for repeated or malformed multi-segment DDP/RDMAP headers arriving on SIW sockets; look for crashes or panics referencing siw_get_hdr or fpdu_part_rcvd corruption; correlate with connection attempts from unexpected sources.
What your security team should do
- Inventory all hosts running RDMA/siw and prioritize patching within standard change windows
- Apply network segmentation to limit exposure of SIW ports to untrusted sources
- Monitor EPSS and KEV status weekly for changes in exploit availability
- Include SIW-related kernel modules in regular vulnerability scanning and patch automation
The record
In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|