CVE-2026-64552

Received Received - Intake

Buffer Overflow in Linux Kernel Virtio-net Driver

Publication date: 2026-07-27

Last updated on: 2026-07-27

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. page_to_skb() then walks one frag past the page chain, storing a NULL page->private into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag handed up the rx path. Bound len by the size add_recvbuf_big() actually advertised.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-27

Last Modified

2026-07-27

Generated

2026-07-28

AI Q&A

2026-07-28

EPSS Evaluated

N/A

NVD

CVE-2026-64552

EUVD

EUVD-2026-49603

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability in the virtio-net driver. It involves a bounds check issue in the receive_big() function where the device-announced length is not properly validated. A malicious virtio backend could exploit this to cause an out-of-bounds write in the kernel's network stack, potentially leading to memory corruption or system crashes.

Detection Guidance

This vulnerability is specific to the Linux kernel's virtio-net driver and requires kernel-level inspection. Detection involves checking kernel version and virtio-net driver behavior. Use commands like 'uname -a' to verify kernel version and 'dmesg | grep virtio_net' to check for related errors. No direct network commands detect this as it is a driver-level issue.

Impact Analysis

If exploited, this vulnerability could allow an attacker with control over a virtio backend to crash the system or execute arbitrary code in the kernel. This could lead to denial of service, privilege escalation, or unauthorized access to sensitive data on affected systems.

Mitigation Strategies

Apply the latest kernel update from your Linux distribution to patch the virtio-net driver. If immediate patching is not possible, disable virtio-net or restrict untrusted virtual machine backends. Monitor vendor advisories for kernel updates addressing CVE-2026-64552.

Hi! I’m here to help you understand CVE-2026-64552. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70