DEBIAN-CVE-2026-64102

In the Linux kernel, the following vulnerability has been resolved:  RDMA/siw: Reject MPA FPDU length underflow before signed receive math  A malicious connected siw peer can send an iWARP FPDU whose MPA length field (chdr->mpalen, 16 bit big-endian, peer-controlled) is smaller than the fixed DDP/RDMAP header for the announced opcode. Soft-iWARP parses the full header in siwgethdr() based on iwarppktinfo[opcode] .hdrlen, but never compares mpalen against that header length.  siwtcprxdata() then derives      srx->fpdupartrem = be16tocpu(mpalen) - fpdupartrcvd                          + MPAHDRSIZE;  where fpdupartrcvd equals iwarppktinfo[opcode].hdrlen at this point. For a tagged WRITE (hdrlen 16, MPAHDRSIZE 2) the smallest on-wire mpalen of 0 yields fpdupartrem = -14, and any mpalen below hdrlen - MPAHDRSIZE underflows to a negative int.  The signed value then flows into siwprocwrite()/siwprocrresp() as      bytes = min(srx->fpdupartrem, srx->skbnew);  is handed to siwcheckmem() as an int len (whose interval check addr + len > mem->va + mem->len is satisfied for a valid base when len is negative), and reaches siwrxdata() -> siwrxkva() / siwrxumem() -> skbcopybits() as a signed copy length. The header copy branch in skbcopybits() promotes that to sizet, producing a multi-gigabyte read.  KASAN under a KUnit harness that drives the real kernel TCP receive path -- a loopback AFINET socketpair, the malformed FPDU written via kernelsendmsg, skdataready firing in softirq, tcpreadsock dispatching to siwtcprxdata -- reports:      BUG: KASAN: use-after-free in skbcopybits+0x284/0x480     Read of size 4294967295 at addr ffff888...     Call Trace:      skbcopybits      siwrxkva      siwrxdata      siwcheckmem      siwprocwrite      siwtcprxdata      tcpreadsock      siwqpllpdataready      tcpdataready      tcpdataqueue  Add the missing invariant at the earliest point where the peer header is fully assembled. iwarppktinfo[*].hdrlen - MPAHDRSIZE is exactly the value the siw transmitter uses as the minimum mpalen for each opcode (drivers/infiniband/sw/siw/siwqp.c:33), so this matches the protocol contract. Out-of-range FPDUs terminate the connection with TERMERRORLAYERLLP / LLPETYPEMPA / LLPECODEFPDU_START -- which is RFC 5044 Section 8 error code 3 ("Marker and ULPDU Length fields do not agree on the start of an FPDU"), the correct framing-error class for this inconsistency.