In the Linux kernel, the following vulnerability has been resolved: ipv4: raw: reject IP_HDRINCL packets with ihl < 5 raw_send_hdrinc() validates… (CVE-2026-64114)

The Linux kernel's raw_send_hdrinc() function did not reject IPv4 packets with an IHL value less than 5, which is malformed by definition. Such packets bypassed certain validation checks, leaving the crafted IP header unmodified but still processed downstream. In particular, the ah_output() function in net/ipv4/ah4.c assumed a valid IHL and performed a memcpy() with a negative length cast to size_t, resulting in an out-of-bounds memory access and a kernel panic. This vulnerability was assigned CVE-2026-64114 and has been fixed in Linux kernel versions 5.15.0-1112.119~20.04.1 and later.

Exploitation of this vulnerability can cause a host kernel panic due to out-of-bounds memory access, leading to denial of service. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability. There are no known exploits in the wild. The vulnerability requires local privileges (low attack vector) and low complexity but does not require user interaction.

A patch is available and should be applied by updating the Linux kernel to versions 5.15.0-1112.119~20.04.1 or later as provided by the vendor. After updating, a system reboot is required to apply the fix. The vendor advisory confirms that this issue is resolved in the specified kernel versions. No additional mitigation steps are necessary beyond applying the official update.