---
id: CVE-2026-64114
title: 'ipv4: raw: reject IP_HDRINCL packets with ihl < 5'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  ipv4: raw: reject IP_HDRINCL packets with ihl < 5

  raw_send_hdrinc() validates that the caller-supplied IPv4 header
  fits within the message length:

      iphlen = iph->i…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    1065b9efa4126df559b03a849c139ecfae92cd25
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    bc20dbd48c26e743f7e0845020c11ed2ce8b15ee
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    5a564f737ec54d63e8ee221d3ff396d07586d464
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    3c5411fa4944ed99af3d9d1de750ea8169b6dac9
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    145e9afa5b905229b4788bb72c3255f5a5f77508
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    7725cd3b471740fd23d25ed1da722c671fb2a5d3
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    bbe0be67de296176e7243c76e3d9f02f6ae9ff0b
  - >-
    Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 <
    915fab69823a14c170dbaa3b41978768e0fe62fc
  - Linux 2.6.12
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:36:31.414892Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:22.975Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64114'
references:
  - url: 'https://git.kernel.org/stable/c/1065b9efa4126df559b03a849c139ecfae92cd25'
  - url: 'https://git.kernel.org/stable/c/bc20dbd48c26e743f7e0845020c11ed2ce8b15ee'
  - url: 'https://git.kernel.org/stable/c/5a564f737ec54d63e8ee221d3ff396d07586d464'
  - url: 'https://git.kernel.org/stable/c/3c5411fa4944ed99af3d9d1de750ea8169b6dac9'
  - url: 'https://git.kernel.org/stable/c/145e9afa5b905229b4788bb72c3255f5a5f77508'
  - url: 'https://git.kernel.org/stable/c/7725cd3b471740fd23d25ed1da722c671fb2a5d3'
  - url: 'https://git.kernel.org/stable/c/bbe0be67de296176e7243c76e3d9f02f6ae9ff0b'
  - url: 'https://git.kernel.org/stable/c/915fab69823a14c170dbaa3b41978768e0fe62fc'
tags:
  - cve.org
epss: 0.00136
epssPercentile: 0.02675
ingestedAt: '2026-10-16T17:24:46.806Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

ipv4: raw: reject IP_HDRINCL packets with ihl < 5

raw_send_hdrinc() validates that the caller-supplied IPv4 header
fits within the message length:

    iphlen = iph->ihl * 4;
    err = -EINVAL;
    if (iphlen > length)
        goto error_free;

    if (iphlen >= sizeof(*iph)) {
        /* fix up saddr, tot_len, id, csum, transport_header */
    }

It does not, however, reject ihl < 5.  For such a packet the
"if (iphlen >= sizeof(*iph))" branch is skipped, leaving the
crafted iphdr untouched, but the packet is still handed to
__ip_local_out() and onward.  Downstream consumers that read
iph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in
particular subtracts sizeof(struct iphdr) from top_iph->ihl * 4
and passes the (signed-int-negative, then cast to size_t)
result to memcpy(), producing an OOB access of length close to
SIZE_MAX and a host kernel panic.

An IPv4 header with ihl < 5 is malformed by definition (RFC 791:
"Internet Header Length is the length of the internet header in
32 bit words ... Note that the minimum value for a correct header
is 5.").  The kernel should not be willing to inject such a
packet into its own output path.

Reject "iphlen < sizeof(*iph)" alongside the existing
"iphlen > length" check.  This matches the principle that locally
constructed packets that re-enter the IP stack must pass the same
basic sanity tests that a foreign packet would be subjected to.

Once this lands, the "if (iphlen >= sizeof(*iph))" wrapper around
the fixup branch becomes redundant; left in place to keep the
patch minimal and backport-friendly.  A follow-up can unwrap it.

Note that commit 86f4c90a1c5c ("ipv4, ipv6: ensure raw socket
message is big enough to hold an IP header") ensures the message
buffer is large enough to hold an iphdr, but does not constrain
the self-reported iph->ihl.

Reachability: the malformed packet source is any caller with
CAP_NET_RAW, including an unprivileged process in a user+net
namespace on a kernel with CONFIG_USER_NS=y.  The reproduced AH
crash also requires a matching xfrm AH policy on the outgoing
route; a container granted CAP_NET_ADMIN can install that state
and policy in its netns.  Loopback bypasses xfrm_output, so the
trigger uses a real netdev.

Reproduced on UML + KASAN: kernel-mode fault at addr 0x0 with
memcpy_orig at the crash site.  Same shape reproduces inside a
rootless Docker container with --cap-add NET_ADMIN on a stock
distro kernel.

## Affected

- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 1065b9efa4126df559b03a849c139ecfae92cd25`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < bc20dbd48c26e743f7e0845020c11ed2ce8b15ee`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 5a564f737ec54d63e8ee221d3ff396d07586d464`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 3c5411fa4944ed99af3d9d1de750ea8169b6dac9`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 145e9afa5b905229b4788bb72c3255f5a5f77508`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 7725cd3b471740fd23d25ed1da722c671fb2a5d3`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < bbe0be67de296176e7243c76e3d9f02f6ae9ff0b`
- `Linux >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 915fab69823a14c170dbaa3b41978768e0fe62fc`
- `Linux 2.6.12`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.