CVE-2026-64550

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> net: qualcomm: rmnet: validate MAP frame length before ingress parsing<br /> <br /> When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes<br /> the skb straight to __rmnet_map_ingress_handler(), skipping the length<br /> validation that rmnet_map_deaggregate() performs on the aggregated path.<br /> The parser then dereferences the MAP header and csum header/trailer based on<br /> the on-wire pkt_len without checking skb-&gt;len, so a short frame is read out<br /> of bounds:<br /> <br /> BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet<br /> Read of size 1 at addr ffff88801118ed00 by task exploit/147<br /> Call Trace:<br /> ...<br /> rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)<br /> __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)<br /> rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)<br /> __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)<br /> netif_receive_skb (net/core/dev.c:6460)<br /> tun_get_user (drivers/net/tun.c:1955)<br /> tun_chr_write_iter (drivers/net/tun.c:2001)<br /> vfs_write (fs/read_write.c:688)<br /> ksys_write (fs/read_write.c:740)<br /> do_syscall_64 (arch/x86/entry/syscall_64.c:94)<br /> ...<br /> <br /> Factor that validation out of rmnet_map_deaggregate() into<br /> rmnet_map_validate_packet_len() and run it on the no-aggregation path too.<br /> The MAP header is bounds-checked first, since this path can receive a frame<br /> shorter than the header.