PT-2026-65225 · Linux · Linux
CVE-2026-64550
·
Published
2026-07-27
·
Updated
2026-07-27
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
net: qualcomm: rmnet: validate MAP frame length before ingress parsing
When ingress deaggregation is disabled, rmnet map ingress handler() passes
the skb straight to rmnet map ingress handler(), skipping the length
validation that rmnet map deaggregate() performs on the aggregated path.
The parser then dereferences the MAP header and csum header/trailer based on
the on-wire pkt len without checking skb->len, so a short frame is read out
of bounds:
BUG: KASAN: slab-out-of-bounds in rmnet map checksum downlink packet
Read of size 1 at addr ffff88801118ed00 by task exploit/147
Call Trace:
...
rmnet map checksum downlink packet (drivers/net/ethernet/qualcomm/rmnet/rmnet map data.c:413)
rmnet map ingress handler (drivers/net/ethernet/qualcomm/rmnet/rmnet handlers.c:96)
rmnet rx handler (drivers/net/ethernet/qualcomm/rmnet/rmnet handlers.c:129)
netif receive skb core.constprop.0 (net/core/dev.c:6089)
netif receive skb (net/core/dev.c:6460)
tun get user (drivers/net/tun.c:1955)
tun chr write iter (drivers/net/tun.c:2001)
vfs write (fs/read write.c:688)
ksys write (fs/read write.c:740)
do syscall 64 (arch/x86/entry/syscall 64.c:94)
...
Factor that validation out of rmnet map deaggregate() into
rmnet map validate packet len() and run it on the no-aggregation path too.
The MAP header is bounds-checked first, since this path can receive a frame
shorter than the header.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux