CVE-2026-64414 addresses a vulnerability in the Linux kernel netfilter subsystem where skb (socket buffer) fragments that are unreadable could lead to unsafe processing. Specifically, when skb_frags_readable(skb) returns false, the u32 module's skb_copy_bits() function now safely returns a negative error code. Additional mitigations include the xt_u32 module bailing out with hotdrop, gather_frags returning -1 as if no fragment header was present, and nfnetlink_queue and nfnetlink_log restricting operations to the linear part of skb data. The patch also corrected skb_zerocopy helpers to avoid copying the readable flag incorrectly, preventing broken behavior in nfnetlink_queue.

The vulnerability could cause improper handling of unreadable skb fragments in netfilter modules, potentially leading to incorrect packet processing or kernel errors. No known exploits in the wild have been reported. The impact is limited to kernel packet filtering and logging subsystems that handle fragmented skb data.

A fix has been implemented in the Linux kernel to safely handle unreadable skb fragments in netfilter components. Users should apply the official kernel updates that include this patch. Since this is a kernel-level vulnerability, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult the Linux kernel vendor advisory for the exact fixed versions and update accordingly.