CVE-2026-53199

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf<br /> <br /> netvsc_copy_to_send_buf() copies page buffer entries into the VMBus<br /> send buffer using phys_to_virt() on the entry PFN. Entries for the<br /> RNDIS header and the skb linear data come from kmalloc&amp;#39;d memory and<br /> are always in the kernel direct map, but entries for skb fragments<br /> reference page cache or user pages, which on 32-bit x86 with<br /> CONFIG_HIGHMEM=y can live above the LOWMEM boundary. For such a page<br /> phys_to_virt() returns an address outside the direct map and the<br /> subsequent memcpy() faults on the transmit softirq path, which is<br /> fatal.<br /> <br /> Map the pages with kmap_local_page() instead, handling two properties<br /> of the page buffer entries:<br /> <br /> - pb[i].pfn is a Hyper-V PFN at HV_HYP_PAGE_SIZE (4K) granularity,<br /> not a native PFN. Reconstruct the physical address first and derive<br /> the native page from it, so the mapping stays correct where<br /> PAGE_SIZE &gt; HV_HYP_PAGE_SIZE (e.g. arm64 with 64K pages).<br /> <br /> - Since commit 41a6328b2c55 ("hv_netvsc: Preserve contiguous PFN<br /> grouping in the page buffer array"), an entry describes a full<br /> physically contiguous fragment and pb[i].len can exceed PAGE_SIZE,<br /> while kmap_local_page() maps a single page. Copy page by page,<br /> splitting at native page boundaries.<br /> <br /> The copy path only handles packets smaller than the send section size<br /> (6144 bytes by default); larger packets take the cp_partial path where<br /> only the RNDIS header is copied. So entries here are bounded by the<br /> section size and a copy is split at most once on 4K-page systems. On<br /> !CONFIG_HIGHMEM configs kmap_local_page() folds to page_address() and<br /> no mapping work is added.