CVE-2026-64102: Software Security Vulnerability Vulnerability

CRITICAL
Advisory Identifier: GHSA-mhgq-v2h6-4f9w
Share
CVSS 9.8
CWE-190 CWE-125
Published
Advisory Summary

CVE-2026-64102 is a CRITICAL (CVSS 9.8) security vulnerability vulnerability (CWE-190: Integer Overflow or Wraparound) affecting Software libraries in the Maven ecosystem. The weakness occurs when the product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. this occurs when an integer value is incremented to a value that is too large to store in the associated representation. when this occurs, the value may become a very small or negative number.. Remediation is available in the latest vendor maintenance releases.

CVE-2026-64102 at a Glance

CVE Identifier CVE-2026-64102
GHSA Identifier GHSA-mhgq-v2h6-4f9w
Severity CRITICAL
CVSS v3.1 Base Score 9.8
CWE Classification CWE-190: Integer Overflow or Wraparound
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 9.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H).

Attack Vector Network (AV:N)
Attack Complexity Low (AC:L)
Privileges Required None (PR:N)
User Interaction None (UI:N)
Scope Unchanged (S:U)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-64102

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-64102, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under CWE-190: Integer Overflow or Wraparound, where the product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. this occurs when an integer value is incremented to a value that is too large to store in the associated representation. when this occurs, the value may become a very small or negative number. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: RDMA/siw: Reject MPA FPDU length underflow before signed receive math A malicious connected siw peer can send an iWARP FPDU whose MPA length field (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode] .hdr_len, but never compares mpa_len against that header length. siw_tcp_rx_data() then derives srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd + MPA_HDR_SIZE; where fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this point. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest on-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below hdr_len - MPA_HDR_SIZE underflows to a negative int. The signed value then flows into siw_proc_write()/siw_proc_rresp() as bytes = min(srx->fpdu_part_rem, srx->skb_new); is handed to siw_check_mem() as an int len (whose interval check addr + len > mem->va + mem->len is satisfied for a valid base when len is negative), and reaches siw_rx_data() -> siw_rx_kva() / siw_rx_umem() -> skb_copy_bits() as a signed copy length. The header copy branch in skb_copy_bits() promotes that to size_t, producing a multi-gigabyte read. KASAN under a KUnit harness that drives the real kernel TCP receive path -- a loopback AF_INET socketpair, the malformed FPDU written via kernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock dispatching to siw_tcp_rx_data -- reports: BUG: KASAN: use-after-free in skb_copy_bits+0x284/0x480 Read of size 4294967295 at addr ffff888... Call Trace: skb_copy_bits siw_rx_kva siw_rx_data siw_check_mem siw_proc_write siw_tcp_rx_data __tcp_read_sock siw_qp_llp_data_ready tcp_data_ready tcp_data_queue Add the missing invariant at the earliest point where the peer header is fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly the value the siw transmitter uses as the minimum mpa_len for each opcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the protocol contract. Out-of-range FPDUs terminate the connection with TERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which is RFC 5044 Section 8 error code 3 ("Marker and ULPDU Length fields do not agree on the start of an FPDU"), the correct framing-error class for this inconsistency.

References

NVD — CVE-2026-64102 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64102
git.kernel.org/stable/c/0ce1bc9e46... WEB
https://git.kernel.org/stable/c/0ce1bc9e46ecabe84772bb561e373c0d9876d6f2
git.kernel.org/stable/c/1012896f42... WEB
https://git.kernel.org/stable/c/1012896f4225e8f801ff3c1648023845b66dfb11
git.kernel.org/stable/c/14553be882... WEB
https://git.kernel.org/stable/c/14553be882d9ce91749c9d64041de66e34ad8e70
git.kernel.org/stable/c/33a8b5e971... WEB
https://git.kernel.org/stable/c/33a8b5e971e294ec2a7b74211c545e09efd8e9ac
git.kernel.org/stable/c/4a33158201... WEB
https://git.kernel.org/stable/c/4a331582011d9e8089af8aa2a61ec6b4443bb245
git.kernel.org/stable/c/683f7cfbf5... WEB
https://git.kernel.org/stable/c/683f7cfbf514193d63c0efa079f3352bde84c2e0
git.kernel.org/stable/c/775b4dc961... WEB
https://git.kernel.org/stable/c/775b4dc9618a99a1fa48b57554041a5dc17e1336
git.kernel.org/stable/c/c7c0c0f437... WEB
https://git.kernel.org/stable/c/c7c0c0f4379dedec12d24dbb9dded5d2db7fd9f2

Frequently Asked Questions

What is CVE-2026-64102?
CVE-2026-64102 is a security vulnerability in Software classified as a security vulnerability vulnerability under CWE-190: Integer Overflow or Wraparound.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-64102?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-64102?
CVE-2026-64102 has a CVSS v3.1 base score of 9.8 (CRITICAL) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
What CWE is associated with CVE-2026-64102?
CVE-2026-64102 is classified under CWE-190: Integer Overflow or Wraparound (The product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.).
How can I check Maven dependencies for CVE-2026-64102?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-mhgq-v2h6-4f9w",
  "modified" : "2026-07-20T15:31:59Z",
  "published" : "2026-07-19T18:31:52Z",
  "aliases" : [ "CVE-2026-64102" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nRDMA/siw: Reject MPA FPDU length underflow before signed receive math\n\nA malicious connected siw peer can send an iWARP FPDU whose MPA length\nfield (c_hdr->mpa_len, 16 bit big-endian, peer-controlled) is smaller\nthan the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP\nparses the full header in siw_get_hdr() based on iwarp_pktinfo[opcode]\n.hdr_len, but never compares mpa_len against that header length.\n\nsiw_tcp_rx_data() then derives\n\n    srx->fpdu_part_rem = be16_to_cpu(mpa_len) - fpdu_part_rcvd\n                         + MPA_HDR_SIZE;\n\nwhere fpdu_part_rcvd equals iwarp_pktinfo[opcode].hdr_len at this\npoint. For a tagged WRITE (hdr_len 16, MPA_HDR_SIZE 2) the smallest\non-wire mpa_len of 0 yields fpdu_part_rem = -14, and any mpa_len below\nhdr_len - MPA_HDR_SIZE underflows to a negative int.\n\nThe signed value then flows into siw_proc_write()/siw_proc_rresp() as\n\n    bytes = min(srx->fpdu_part_rem, srx->skb_new);\n\nis handed to siw_check_mem() as an int len (whose interval check\naddr + len > mem->va + mem->len is satisfied for a valid base when\nlen is negative), and reaches siw_rx_data() -> siw_rx_kva() /\nsiw_rx_umem() -> skb_copy_bits() as a signed copy length. The header\ncopy branch in skb_copy_bits() promotes that to size_t, producing a\nmulti-gigabyte read.\n\nKASAN under a KUnit harness that drives the real kernel TCP receive\npath -- a loopback AF_INET socketpair, the malformed FPDU written via\nkernel_sendmsg, sk_data_ready firing in softirq, tcp_read_sock\ndispatching to siw_tcp_rx_data -- reports:\n\n    BUG: KASAN: use-after-free in skb_copy_bits+0x284/0x480\n    Read of size 4294967295 at addr ffff888...\n    Call Trace:\n     skb_copy_bits\n     siw_rx_kva\n     siw_rx_data\n     siw_check_mem\n     siw_proc_write\n     siw_tcp_rx_data\n     __tcp_read_sock\n     siw_qp_llp_data_ready\n     tcp_data_ready\n     tcp_data_queue\n\nAdd the missing invariant at the earliest point where the peer header\nis fully assembled. iwarp_pktinfo[*].hdr_len - MPA_HDR_SIZE is exactly\nthe value the siw transmitter uses as the minimum mpa_len for each\nopcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the\nprotocol contract. Out-of-range FPDUs terminate the connection with\nTERM_ERROR_LAYER_LLP / LLP_ETYPE_MPA / LLP_ECODE_FPDU_START -- which\nis RFC 5044 Section 8 error code 3 (\"Marker and ULPDU Length fields\ndo not agree on the start of an FPDU\"), the correct framing-error\nclass for this inconsistency.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-64102"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/0ce1bc9e46ecabe84772bb561e373c0d9876d6f2"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/1012896f4225e8f801ff3c1648023845b66dfb11"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/14553be882d9ce91749c9d64041de66e34ad8e70"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/33a8b5e971e294ec2a7b74211c545e09efd8e9ac"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4a331582011d9e8089af8aa2a61ec6b4443bb245"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/683f7cfbf514193d63c0efa079f3352bde84c2e0"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/775b4dc9618a99a1fa48b57554041a5dc17e1336"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/c7c0c0f4379dedec12d24dbb9dded5d2db7fd9f2"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-125", "CWE-190" ],
    "severity" : "CRITICAL",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-07-19T16:17:51Z"
  }
}