CVE-2026-64552

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> virtio-net: fix len check in receive_big()<br /> <br /> receive_big() bounds the device-announced length by<br /> (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose:<br /> add_recvbuf_big() sets sg[1] to start at offset<br /> sizeof(struct padded_vnet_hdr) into the first page, so the chain<br /> actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +<br /> big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the<br /> check allows for the common hdr_len == 12 case.<br /> <br /> A malicious virtio backend can announce a len in that gap. page_to_skb()<br /> then walks one frag past the page chain, storing a NULL page-&gt;private<br /> into skb_shinfo()-&gt;frags[MAX_SKB_FRAGS], which is both an out-of-bounds<br /> write past the static frag array and a NULL frag handed up the rx path.<br /> <br /> Bound len by the size add_recvbuf_big() actually advertised.