PT-2026-65227 · Linux · Linux
CVE-2026-64552
·
Published
2026-07-27
·
Updated
2026-07-27
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
virtio-net: fix len check in receive big()
receive big() bounds the device-announced length by
(big packets num skbfrags + 1) * PAGE SIZE. That is still too loose:
add recvbuf big() sets sg[1] to start at offset
sizeof(struct padded vnet hdr) into the first page, so the chain
actually carries hdr len + (PAGE SIZE - sizeof(padded vnet hdr)) +
big packets num skbfrags * PAGE SIZE bytes -- 20 bytes less than the
check allows for the common hdr len == 12 case.
A malicious virtio backend can announce a len in that gap. page to skb()
then walks one frag past the page chain, storing a NULL page->private
into skb shinfo()->frags[MAX SKB FRAGS], which is both an out-of-bounds
write past the static frag array and a NULL frag handed up the rx path.
Bound len by the size add recvbuf big() actually advertised.
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux