In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 raw_send_hdrinc() validates that the caller-supplied IPv4 header fits within the message length: iphlen = iph->ihl * 4; err = -EINVAL; if (iphlen > length) goto error_free; if (iphlen >= sizeof(*iph)) { /* fix up saddr, tot_len, id, csum, transport_header */ } It does not, however, reject ihl < 5. For such a packet the "if (iphlen >= sizeof(*iph))" branch is skipped, leaving the crafted iphdr untouched, but the packet is still handed to __ip_local_out() and onward. Downstream consumers that read iph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in particular subtracts sizeof(struct iphdr) from top_iph->ihl * 4 and passes the (signed-int-negative, then cast to size_t) result to memcpy(), producing an OOB access of length close to SIZE_MAX and a host kernel panic. An IPv4 header with ihl < 5 is malformed by definition (RFC 791: "Internet Header Length is the length of the internet header in 32 bit words ... Note that the minimum value for a correct header is 5."). The kernel should not be willing to inject such a packet into its own output path. Reject "iphlen < sizeof(*iph)" alongside the existing "iphlen > length" check. This matches the principle that locally constructed packets that re-enter the IP stack must pass the same basic sanity tests that a foreign packet would be subjected to. Once this lands, the "if (iphlen >= sizeof(*iph))" wrapper around the fixup branch becomes redundant; left in place to keep the patch minimal and backport-friendly. A follow-up can unwrap it. Note that commit 86f4c90a1c5c ("ipv4, ipv6: ensure raw socket message is big enough to hold an IP header") ensures the message buffer is large enough to hold an iphdr, but does not constrain the self-reported iph->ihl. Reachability: the malformed packet source is any caller with CAP_NET_RAW, including an unprivileged process in a user+net namespace on a kernel with CONFIG_USER_NS=y. The reproduced AH crash also requires a matching xfrm AH policy on the outgoing route; a container granted CAP_NET_ADMIN can install that state and policy in its netns. Loopback bypasses xfrm_output, so the trigger uses a real netdev. Reproduced on UML + KASAN: kernel-mode fault at addr 0x0 with memcpy_orig at the crash site. Same shape reproduces inside a rootless Docker container with --cap-add NET_ADMIN on a stock distro kernel.

An update of the linux package has been released.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - ipv4: raw: reject IP_HDRINCL packets with ihl < 5 raw_send_hdrinc() validates that the caller-supplied     IPv4 header fits within the message length: iphlen = iph->ihl * 4; err = -EINVAL; if (iphlen > length)     goto error_free; if (iphlen >= sizeof(*iph)) { /* fix up saddr, tot_len, id, csum, transport_header */ }     It does not, however, reject ihl < 5. For such a packet the if (iphlen >= sizeof(*iph)) branch is     skipped, leaving the crafted iphdr untouched, but the packet is still handed to __ip_local_out() and     onward. Downstream consumers that read iph->ihl assume a sane value: net/ipv4/ah4.c:ah_output() in     particular subtracts sizeof(struct iphdr) from top_iph->ihl * 4 and passes the (signed-int-negative, then     cast to size_t) result to memcpy(), producing an OOB access of length close to SIZE_MAX and a host kernel     panic. An IPv4 header with ihl < 5 is malformed by definition (RFC 791: Internet Header Length is the     length of the internet header in 32 bit words ... Note that the minimum value for a correct header is     5.). The kernel should not be willing to inject such a packet into its own output path. Reject iphlen <     sizeof(*iph) alongside the existing iphlen > length check. This matches the principle that locally     constructed packets that re-enter the IP stack must pass the same basic sanity tests that a foreign packet     would be subjected to. Once this lands, the if (iphlen >= sizeof(*iph)) wrapper around the fixup branch     becomes redundant; left in place to keep the patch minimal and backport-friendly. A follow-up can unwrap     it. Note that commit 86f4c90a1c5c (ipv4, ipv6: ensure raw socket message is big enough to hold an IP     header) ensures the message buffer is large enough to hold an iphdr, but does not constrain the self-     reported iph->ihl. Reachability: the malformed packet source is any caller with CAP_NET_RAW, including an     unprivileged process in a user+net namespace on a kernel with CONFIG_USER_NS=y. The reproduced AH crash     also requires a matching xfrm AH policy on the outgoing route; a container granted CAP_NET_ADMIN can     install that state and policy in its netns. Loopback bypasses xfrm_output, so the trigger uses a real     netdev. Reproduced on UML + KASAN: kernel-mode fault at addr 0x0 with memcpy_orig at the crash site. Same     shape reproduces inside a rootless Docker container with --cap-add NET_ADMIN on a stock distro kernel.
    (CVE-2026-64114)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
333944	Photon OS 5.0: Linux PHSA-2026-5.0-92-0864	Nessus	PhotonOS Local Security Checks	Local	high
333941	Photon OS 5.0: Linux PHSA-2026-5.0-92-0926	Nessus	PhotonOS Local Security Checks	Local	high
329326	Photon OS 5.0: Linux PHSA-2026-5.0-0926	Nessus	PhotonOS Local Security Checks	Local	high
328322	Linux Distros Unpatched Vulnerability : CVE-2026-64114	Nessus	Misc.	Local	high
322107	Amazon Linux 2023 : bpftool6.12, kernel6.12, kernel6.12-devel (ALAS2023-2026-1894)	Nessus	Amazon Linux Local Security Checks	Local	high
322088	Amazon Linux 2023 : bpftool, kernel, kernel-devel (ALAS2023-2026-1882)	Nessus	Amazon Linux Local Security Checks	Local	high
322087	Amazon Linux 2023 : bpftool6.18, kernel6.18, kernel6.18-devel (ALAS2023-2026-1881)	Nessus	Amazon Linux Local Security Checks	Local	medium
322048	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.15-2026-107 (ALASKERNEL-5.15-2026-107)	Nessus	Amazon Linux Local Security Checks	Local	high
321988	Amazon Linux 2 : kernel, --advisory ALAS2KERNEL-5.10-2026-123 (ALASKERNEL-5.10-2026-123)	Nessus	Amazon Linux Local Security Checks	Local	high
318773	Photon OS 5.0: Linux PHSA-2026-5.0-0864	Nessus	PhotonOS Local Security Checks	Local	high

Detections

Analytics

CVE-2026-64114

high

Tenable Plugins

high

high

high

high

high

high

medium

high

high

high