9.8

CVE-2026-98323: RDMA/siw: Bound fragmented header copies by the remaining length

Received
AliasesUBUNTU-CVE-2026-98323DEBIAN-CVE-2026-98323
Published 06-10-2026Last modified 19-10-2026

Vulnerability summary

CVE-2026-98323 is a critical (CVSS 9.8) vulnerability in linux. EPSS estimates a 0.51% chance of exploitation in the next 30 days, higher than 43.8% of scored vulnerabilities.

Priority
Prioritisesevere

Severe, CVSS 9.8 (CVE.org); no exploitation reported by the 5 checked sources; EPSS 1% (FIRST, 03-11-2026)

Source freshness unavailable

How is this decided?
CVSS score
9.8/10
010
Critical · v3.1 (CVE.org)
EPSS score
0.51%
0%100%
Low · Change unavailable
KEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 15 · Related 15
OPENSUSE-SU-2026:12131-1OPENSUSE-SU-2026:22167-1SUSE-SU-2026:24371-1SUSE-SU-2026:24379-1SUSE-SU-2026:24386-1SUSE-SU-2026:24422-1

Timeline

  1. 06-10-2026
    PublishedVulnerability first disclosed.
  2. 19-10-2026
    Last modifiedVulnerability information updated.

Description

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Bound fragmented header copies by the remaining length siw_get_hdr() can receive an extended DDP/RDMAP header across more than one TCP callback. The first callback may receive most of the header, while the next one still limits the copy to hdrlen - MIN_DDP_HDR instead of the number of missing bytes. This makes the destination move past the end of the header and overwrite the receive state, including fpdu_part_rcvd. A later callback can then use a negative fpdu_part_rcvd value as a copy offset, which creates an OOB write. Use the number of header bytes already received when calculating the next copy length.

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

0.51%

Chance of exploitation in the next 30 days

Percentile

44%

Versus all other CVEs

30-day change

Change unavailable

Change unavailable

06-10-202603-11-2026

Known exploited

Compare KEV catalogs
CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Version check

Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.

Ubuntu165 products
  • linuxAll versions (No fix recorded)
  • linux-allwinner-5.19All versions (No fix recorded)
  • linux-awsAll versions (No fix recorded)
  • linux-aws-5.0All versions (No fix recorded)
  • linux-aws-5.11All versions (No fix recorded)
Debian2 products
  • linuxAll versions (No fix recorded) | < 6.1.190-1 | < 6.12.113-1 | < 7.2.8-1
  • linux-6.12< 6.12.113-1~deb12u1
Linux1 product
  • linux≥ e3917c85f41ef1df64e27dc0e46ab0d803c5e73e, < 2c6fbcf4bfac0b2b186acc8d91154c0fa24468a7 | ≥ 308cd50f174c95a507527037f4de1a0396aa4325, < af9f5b474a260ad23ffb9793d716a5e3bbce3b48 | ≥ 754209850df8367c954ac1de7671c7430b1f342c, < 262dcd809723723ed8a4e05437ec7e9c21a8f17e | ≥ 754209850df8367c954ac1de7671c7430b1f342c, < eb4d7a946970469b3ab0c762432bf161d5b0836c | ≥ 754209850df8367c954ac1de7671c7430b1f342c, < 8628f8ebf41669302513fb3f0bf0eba38b226742 | ≥ 754209850df8367c954ac1de7671c7430b1f342c, < b72dcfb9bf1f0f0147cda03dc59e4002a315067f | ≥ 754209850df8367c954ac1de7671c7430b1f342c, < e6bdfdf3bcb02d0d626a45e8c98b7e63d2fddf9d | ≥ 754209850df8367c954ac1de7671c7430b1f342c, < 9ff797e516dbc1ecb73701ec4c24055712d44411 | e09caa38e10bcf027100cc22b0e3cc745a39ef0a | 0c14f795a9eab9344230f9933798b8ee496f497d | 7fada7c6962219b6fc4ff4e62e46a936af110dd9 | ≥ 5.10.150, < 5.10.271 | ≥ 5.15.75, < 5.15.222 | ≥ 5.4.220, < 5.5 | ≥ 5.19.17, < 5.20 | ≥ 6.0.3, < 6.1 | 6.1

3 vendors · 168 products

References

12 links
Show all 12 references