CVE-2026-64414

CVE-2026-64414 is a memory safety vulnerability in the Linux kernel's netfilter subsystem. Three components—xt_u32 target, nfnetlink_queue, and nfnetlink_log—fail to verify that skb fragment data is CPU-readable before processing packets. The root cause is devmem TCP, a zero-copy networking feature that allows packet fragments to exist in memory without being mapped into CPU address space. When a packet with unreadable fragments reaches these netfilter handlers, they attempt to read fragment data without checking `skb_frags_readable()`, leading to potential information disclosure or denial of service. Affected systems: kernels with CONFIG_DEV_MEM and CONFIG_NET_DEVMEM enabled, running netfilter rules that process packets through xt_u32, nfnetlink_queue (NFQUEUE), or nfnetlink_log (NFLOG). The vulnerability triggers when packets with devmem-referenced fragments hit these hooks. Immediate actions: First, determine if your kernel has devmem TCP enabled (`zcat /proc/config.gz | grep DEV_MEM` or check `/boot/config-*`). If devmem TCP is not required in your environment, disable it. Second, audit netfilter rulesets for NFQUEUE and NFLOG targets—these are the primary triggers. Third, apply kernel patches which restrict these components to linear skb data only, adding error checking around `skb_copy_bits()` calls. The patch pattern across all three components adds checks that return errors when fragments are not readable, effectively restricting processing to linear buffer data. If you cannot patch immediately, network isolation and dropping NFQUEUE/NFLOG rules provides mitigation. Note that this vulnerability likely affects additional netfilter modules beyond these three. The pattern—fragments being assumed readable when they reach data-path hooks—is a broader architectural issue. Treat this CVE as evidence of a vulnerability class rather than a complete enumeration.

Reviewed through automated stages and approved by a human before publication.