In the Linux kernel, the following vulnerability has been resolved:
virtio-net: fix len check in receive_big()
receive_big() bounds the device-announced length by
(big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose:
add_recvbuf_big() sets sg[1] to start at offset
sizeof(struct padded_vnet_hdr) into the first page, so the chain
actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +
big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the
check allows for the common hdr_len == 12 case.
A malicious virtio backend can announce a len in that gap. page_to_skb()
then walks one frag past the page chain, storing a NULL page->private
into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds
write past the static frag array and a NULL frag handed up the rx path.
Bound len by the size add_recvbuf_big() actually advertised.
References
Configurations
Configuration 1 (hide)
|
History
13 Nov 2026, 18:22
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Linux linux Kernel
Linux |
|
| CPE | cpe:2.3:o:linux:linux_kernel:6.18:rc7:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.18:rc6:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.18:rc5:*:*:*:*:*:* cpe:2.3:o:linux:linux_kernel:6.18:-:*:*:*:*:*:* |
|
| References | () https://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502 - Patch | |
| References | () https://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4 - Patch | |
| References | () https://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49 - Patch | |
| References | () https://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e - Patch | |
| References | () https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986 - Patch | |
| References | () https://git.kernel.org/stable/c/fbeb65154583879d556ea94cb2f15888e9470f3d - Patch | |
| References | () https://cert-portal.siemens.com/productcert/html/ssa-019113.html - Third Party Advisory | |
| References | () https://cert-portal.siemens.com/productcert/html/ssa-457936.html - Third Party Advisory |
19 Oct 2026, 21:17
| Type | Values Removed | Values Added |
|---|---|---|
| CWE | CWE-787 |
15 Oct 2026, 02:20
| Type | Values Removed | Values Added |
|---|---|---|
| References |
|
Information
Published : 2026-07-27 21:17
Updated : 2026-11-13 18:22
NVD link : CVE-2026-64552
Mitre link : CVE-2026-64552
CVE.ORG link : CVE-2026-64552
JSON object : View
Products Affected
linux
- linux_kernel
CWE
CWE-787
Out-of-bounds Write