CVE-2026-64547 in Linux
Summary
by MITRE • 07/28/2026
In the Linux kernel, the following vulnerability has been resolved:
net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
For an even packet_len, net1080_rx_fixup() reads the pad byte at skb->data[packet_len] before the skb->len != packet_len check further
down, and packet_len is only bounded against NC_MAX_PACKET. A malicious NetChip 1080 device can send a short frame advertising a large even packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the skb:
BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14 ... net1080_rx_fixup (drivers/net/usb/net1080.c:384) usbnet_bh (drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3708) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) ...
Reject the frame when packet_len >= skb->len before reading.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability in the Linux kernel's net1080 driver represents a classic buffer over-read flaw that can be exploited through improper input validation during USB network packet processing. This issue specifically affects the net1080 USB network driver which implements the NetChip 1080 chipset support, creating a scenario where malicious devices can manipulate frame length parameters to trigger memory access violations.
The technical flaw exists within the net1080_rx_fixup function located in drivers/net/usb/net1080.c at line 384, where the driver reads a pad byte from skb->data[packet_len] without first validating that this memory access remains within the bounds of the actual received packet data. The vulnerability stems from the fact that packet_len is only validated against NC_MAX_PACKET constant which sets an upper limit but does not ensure that the specified packet length does not exceed the actual skb->len value. When a malicious NetChip 1080 device sends a short frame advertising an artificially inflated even packet length, such as 0x4000, the subsequent memory read operation accesses kernel memory beyond the legitimate packet boundaries.
This buffer over-read condition creates a serious security risk that can lead to kernel memory corruption and potential privilege escalation. The vulnerability manifests through the KASAN (Kernel Address Sanitizer) detection system which identifies the out-of-bounds memory access during the net1080_rx_fixup function execution. The call stack shows this issue occurring during USB network processing where ksoftirqd/0 thread handles network interrupts, indicating that normal USB network operations can trigger this flaw without requiring special privileges or direct user interaction.
The operational impact extends beyond simple memory corruption as this vulnerability can be exploited by malicious USB network devices to cause system instability, crashes, or potentially enable attackers to execute arbitrary code within kernel space. The issue affects systems running Linux kernels with USB network support and particularly those utilizing NetChip 1080 based USB network adapters, making it a significant concern for embedded systems and network infrastructure devices that rely on such hardware.
Security mitigations should focus on implementing proper input validation before memory access operations, specifically requiring that packet_len values be validated against the actual skb->len before any data reads occur. The fix involves adding a bounds check to reject frames where packet_len >= skb->len prior to accessing pad bytes, thereby preventing the out-of-bounds memory access. This approach aligns with CWE-129 Input Validation and Output Processing principles, ensuring that all input parameters are properly validated against expected ranges before processing. Additionally, implementing proper error handling for malformed network frames and establishing defensive programming practices around buffer boundary checks will help prevent similar vulnerabilities in other USB network drivers.
The vulnerability pattern follows ATT&CK technique T1068, where an attacker exploits a privilege escalation vector through kernel memory corruption, potentially allowing them to gain elevated privileges. The mitigation strategy should also include implementing proper kernel memory protection mechanisms and ensuring that all USB network driver components perform adequate bounds checking on received data before processing operations. This fix demonstrates the importance of defensive programming practices in kernel space code where malicious inputs can lead to severe security implications rather than simple functional failures.
This vulnerability classifies as a memory safety issue under the broader category of buffer over-reads, which are commonly exploited in kernel exploitation scenarios. The resolution requires careful attention to input validation and bounds checking in USB network processing routines, with particular emphasis on ensuring that all packet length parameters are properly validated against actual received data lengths before any memory access operations occur.