CVE-2026-64047: linux Off-by-one Error
Vulnerability summary
CVE-2026-64047 is a critical (CVSS 9.8) Off-by-one Error vulnerability in linux. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 42.5% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 47 · Related 47Timeline
- 19-07-2026PublishedVulnerability first disclosed.
- 19-10-2026Last modifiedVulnerability information updated.
Description
In the Linux kernel, the following vulnerability has been resolved: net: tls: fix off-by-one in sg_chain entry count for wrapped sk_msg ring When an sk_msg scatterlist ring wraps (sg.end < sg.start), tls_push_record() chains the tail portion of the ring to the head using sg_chain(). An extra entry in the sg array is reserved for this: struct sk_msg_sg { [...] /* The extra two elements: * 1) used for chaining the front and sections when the list becomes * partitioned (e.g. end < start). The crypto APIs require the * chaining; * 2) to chain tailer SG entries after the message. */ struct scatterlist data[MAX_MSG_FRAGS + 2]; The current code uses MAX_SKB_FRAGS + 1 as the ring size: sg_chain(&msg_pl->sg.data[msg_pl->sg.start], MAX_SKB_FRAGS - msg_pl->sg.start + 1, msg_pl->sg.data); This places the chain pointer at sg_chain(data[start], (MAX_SKB_FRAGS - msg_start + 1) .. = &data[start] + (MAX_SKB_FRAGS - msg_start + 1) - 1 = data[start + (MAX_SKB_FRAGS - start + 1) - 1] = data[MAX_SKB_FRAGS] instead of the true last entry. This is likely due to a "race" of the commit under Fixes landing close to commit 031097d9e079 ("bpf: sk_msg, zap ingress queue on psock down") Convert to ARRAY_SIZE and drop the data[start] / - start (as suggested by Sabrina).
CVSS metrics
4 scores · 4 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- OSV · DebianEcosystem advisory · calculated9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- NVDNIST9.8CriticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS trend
Probability
0.51%
Chance of exploitation in the next 30 days
Percentile
43%
Versus all other CVEs
30-day change
0.00 pp
From 0.51% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-193Off-by-one ErrorA product calculates or uses an incorrect maximum or minimum value that is 1 more, or 1 less, than the correct value.
- CWE-191Integer Underflow (Wrap or Wraparound)The product subtracts one value from another, such that the result is less than the minimum allowable integer value, which produces a value that is not equal to the correct result.
Affected systems
Ubuntu163 products
- linuxAll versions (No fix recorded) | < 5.15.0-186.196 | < 6.8.0-139.139 | < 7.0.0-28.28
- linux-allwinner-5.19All versions (No fix recorded)
- linux-awsAll versions (No fix recorded) | < 5.15.0-1112.119 | < 6.8.0-1064.67 | < 7.0.0-1009.9
- linux-aws-5.0All versions (No fix recorded)
- linux-aws-5.11All versions (No fix recorded)
Linux2 products
- linux≥ 9aaaa56845a06aeabdd597cbe19492dc01f281ec, < 73963a375885d5ccb7def39fd0b4f542e0f343dd | ≥ 9aaaa56845a06aeabdd597cbe19492dc01f281ec, < 47110c3a9ac247b688657337f5981efcfcb240dc | ≥ 9aaaa56845a06aeabdd597cbe19492dc01f281ec, < 84158c2997159df4a0d70cd9c46774512d32a522 | ≥ 9aaaa56845a06aeabdd597cbe19492dc01f281ec, < 131ef12057d92b77b636321b7849c69222405a97 | ≥ 9aaaa56845a06aeabdd597cbe19492dc01f281ec, < 66339b71f105e6f83e0da3b9583d95077534fe1d | ≥ 9aaaa56845a06aeabdd597cbe19492dc01f281ec, < eca989eab4b2599dcb02f72140a7c08f08838520 | ≥ 9aaaa56845a06aeabdd597cbe19492dc01f281ec, < 2fb0dc7e0099686c4e9d2732745d8a31b18c3628 | ≥ 9aaaa56845a06aeabdd597cbe19492dc01f281ec, < 285943c6e7ca309bbea84b253745154241d9788a | d529d6c9f7e3aaeac13c4948f79799ccb825f29d | ≥ 5.4.14, < 5.5 | 5.5
- linux_kernel≥ 5.4.14, < 5.5 | ≥ 5.5.1, < 5.10.258 | ≥ 5.11, < 5.15.209 | ≥ 5.16, < 6.1.175 | ≥ 6.2, < 6.6.142 | ≥ 6.7, < 6.12.92 | ≥ 6.13, < 6.18.34 | ≥ 6.19, < 7.0.11 | 5.5 | 5.5:rc7 | 7.1:rc1 | 7.1:rc2 | 7.1:rc3
Debian1 product
- linux< 6.1.176-1 | < 6.12.94-1 | < 7.0.12-1
3 vendors · 166 products
