CVE-2026-64550

Received Received - Intake

Buffer Overflow in Linux Kernel rmnet Driver

Publication date: 2026-07-27

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handler(), skipping the length validation that rmnet_map_deaggregate() performs on the aggregated path. The parser then dereferences the MAP header and csum header/trailer based on the on-wire pkt_len without checking skb->len, so a short frame is read out of bounds: BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet Read of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: ... rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413) __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089) netif_receive_skb (net/core/dev.c:6460) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2001) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Factor that validation out of rmnet_map_deaggregate() into rmnet_map_validate_packet_len() and run it on the no-aggregation path too. The MAP header is bounds-checked first, since this path can receive a frame shorter than the header.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-08-17

Generated

2026-08-17

AI Q&A

2026-07-28

EPSS Evaluated

2026-08-16

NVD

CVE-2026-64550

EUVD

EUVD-2026-49601

Affected Vendors & Products

Vendor	Product	Version / Range
qualcomm	rmnet	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel affects the Qualcomm rmnet driver. When network frame deaggregation is disabled, the parser skips length validation and directly processes frames. This leads to reading out-of-bounds memory when the frame is shorter than expected, potentially causing crashes or arbitrary code execution.

Detection Guidance

This vulnerability affects the Linux kernel's Qualcomm rmnet driver. Detection requires checking if your system uses a vulnerable kernel version with the rmnet module. Inspect kernel logs for KASAN slab-out-of-bounds errors related to rmnet_map_checksum_downlink_packet. No specific commands are provided in the context.

Impact Analysis

An attacker could exploit this to crash the system or execute malicious code with kernel privileges. This may lead to denial-of-service, data corruption, or unauthorized access to sensitive information on affected devices using the rmnet driver.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a low-level kernel memory corruption issue in the Linux network stack. It could potentially lead to denial of service or unauthorized memory access, but there is no evidence it involves data exfiltration or privacy violations that would trigger these regulations.

Mitigation Strategies

Update your Linux kernel to a patched version that includes the fix for this vulnerability. The patch moves packet length validation into rmnet_map_validate_packet_len() and applies it to both aggregation and non-aggregation paths. Disable ingress deaggregation if not required.

Hi! I’m here to help you understand CVE-2026-64550. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70