PT-2026-65225 · Linux · Linux
CVE-2026-64550
·
Publicado
2026-07-27
·
Atualizado
2026-07-27
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
net: qualcomm: rmnet: validate MAP frame length before ingress parsing
When ingress deaggregation is disabled, rmnet map ingress handler() passes
the skb straight to rmnet map ingress handler(), skipping the length
validation that rmnet map deaggregate() performs on the aggregated path.
The parser then dereferences the MAP header and csum header/trailer based on
the on-wire pkt len without checking skb->len, so a short frame is read out
of bounds:
BUG: KASAN: slab-out-of-bounds in rmnet map checksum downlink packet
Read of size 1 at addr ffff88801118ed00 by task exploit/147
Call Trace:
...
rmnet map checksum downlink packet (drivers/net/ethernet/qualcomm/rmnet/rmnet map data.c:413)
rmnet map ingress handler (drivers/net/ethernet/qualcomm/rmnet/rmnet handlers.c:96)
rmnet rx handler (drivers/net/ethernet/qualcomm/rmnet/rmnet handlers.c:129)
netif receive skb core.constprop.0 (net/core/dev.c:6089)
netif receive skb (net/core/dev.c:6460)
tun get user (drivers/net/tun.c:1955)
tun chr write iter (drivers/net/tun.c:2001)
vfs write (fs/read write.c:688)
ksys write (fs/read write.c:740)
do syscall 64 (arch/x86/entry/syscall 64.c:94)
...
Factor that validation out of rmnet map deaggregate() into
rmnet map validate packet len() and run it on the no-aggregation path too.
The MAP header is bounds-checked first, since this path can receive a frame
shorter than the header.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux