CVE-2026-64102

In the Linux kernel, the following vulnerability has been resolved:

RDMA/siw: Reject MPA FPDU length underflow before signed receive math

A malicious connected siw peer can send an iWARP FPDU whose MPA length

field (chdr->mpalen, 16 bit big-endian, peer-controlled) is smaller

than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP

parses the full header in siwgethdr() based on iwarp_pktinfo[opcode]

.hdrlen, but never compares mpalen against that header length.

siwtcprx_data() then derives

    srx->fpdupartrem = be16tocpu(mpalen) - fpdupart_rcvd

                         + MPAHDRSIZE;

where fpdupartrcvd equals iwarppktinfo[opcode].hdrlen at this

point. For a tagged WRITE (hdrlen 16, MPAHDR_SIZE 2) the smallest

on-wire mpalen of 0 yields fpdupartrem = -14, and any mpalen below

hdrlen - MPAHDR_SIZE underflows to a negative int.

The signed value then flows into siwprocwrite()/siwprocrresp() as

    bytes = min(srx->fpdupartrem, srx->skb_new);

is handed to siwcheckmem() as an int len (whose interval check

addr + len > mem->va + mem->len is satisfied for a valid base when

len is negative), and reaches siwrxdata() -> siwrxkva() /

siwrxumem() -> skbcopybits() as a signed copy length. The header

copy branch in skbcopybits() promotes that to size_t, producing a

multi-gigabyte read.

KASAN under a KUnit harness that drives the real kernel TCP receive

path -- a loopback AF_INET socketpair, the malformed FPDU written via

kernelsendmsg, skdataready firing in softirq, tcpread_sock

dispatching to siwtcprx_data -- reports:

    BUG: KASAN: use-after-free in skbcopybits+0x284/0x480

    Read of size 4294967295 at addr ffff888...

    Call Trace:

     skbcopybits

     siwrxkva

     siwrxdata

     siwcheckmem

     siwprocwrite

     siwtcprx_data

     _tcpread_sock

     siwqpllpdataready

     tcpdataready

     tcpdataqueue

Add the missing invariant at the earliest point where the peer header

is fully assembled. iwarppktinfo[*].hdrlen - MPAHDRSIZE is exactly

the value the siw transmitter uses as the minimum mpa_len for each

opcode (drivers/infiniband/sw/siw/siw_qp.c:33), so this matches the

protocol contract. Out-of-range FPDUs terminate the connection with

TERMERRORLAYERLLP / LLPETYPEMPA / LLPECODEFPDUSTART -- which

is RFC 5044 Section 8 error code 3 ("Marker and ULPDU Length fields

do not agree on the start of an FPDU"), the correct framing-error

class for this inconsistency.