PT-2026-65227 · Linux · Linux
CVE-2026-64552
·
Publicado
2026-07-27
·
Atualizado
2026-07-27
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
virtio-net: fix len check in receive big()
receive big() bounds the device-announced length by
(big packets num skbfrags + 1) * PAGE SIZE. That is still too loose:
add recvbuf big() sets sg[1] to start at offset
sizeof(struct padded vnet hdr) into the first page, so the chain
actually carries hdr len + (PAGE SIZE - sizeof(padded vnet hdr)) +
big packets num skbfrags * PAGE SIZE bytes -- 20 bytes less than the
check allows for the common hdr len == 12 case.
A malicious virtio backend can announce a len in that gap. page to skb()
then walks one frag past the page chain, storing a NULL page->private
into skb shinfo()->frags[MAX SKB FRAGS], which is both an out-of-bounds
write past the static frag array and a NULL frag handed up the rx path.
Bound len by the size add recvbuf big() actually advertised.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux