CVE-2026-64414 is a vulnerability in the Linux kernel's netfilter subsystem where skb (socket buffer) fragments that are unreadable (e.g., from devmem TCP) were not properly handled. Specifically, skb_copy_bits() returns a negative error code when fragments are unreadable, but modules like xt_u32 did not correctly handle this, potentially leading to improper packet processing or hotdrop conditions. The fix involves ensuring xt_u32 bails out with hotdrop in such cases, gather_frags returns -1 as if no fragment header exists, and nfnetlink_queue and nfnetlink_log restrict processing to the linear part of the skb. The patch corrects these behaviors to prevent kernel instability or denial of service.

The vulnerability can cause denial of service (DoS) by improper handling of unreadable skb fragments in the netfilter subsystem, leading to dropped packets or kernel instability. There is no indication of confidentiality or integrity impact. The CVSS score is 7.5 with an impact primarily on availability.

A patch is available and should be applied by updating to the fixed Linux kernel versions as specified by the vendor. After updating, a system reboot is required. Due to an ABI change, recompilation and reinstallation of third-party kernel modules may be necessary. Follow the vendor's update instructions carefully to ensure full remediation.