CVE-2026-64552 in Linux
Summary
by MITRE • 07/28/2026
In the Linux kernel, the following vulnerability has been resolved:
virtio-net: fix len check in receive_big()
receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset
sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case.
A malicious virtio backend can announce a len in that gap. page_to_skb() then walks one frag past the page chain, storing a NULL page->private into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds
write past the static frag array and a NULL frag handed up the rx path.
Bound len by the size add_recvbuf_big() actually advertised.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/28/2026
The vulnerability identified in the Linux kernel's virtio-net implementation represents a critical buffer overflow condition that arises from an incorrect length validation in the receive_big() function. This flaw occurs within the virtual network device driver where the kernel performs bounds checking on packets received from a malicious virtio backend. The specific issue stems from how the function calculates the maximum allowable packet length by using a formula that is overly permissive, creating a gap of exactly 20 bytes in the validation logic. The technical implementation involves the interaction between add_recvbuf_big() which sets up scatter-gather fragments with a header offset of sizeof(struct padded_vnet_hdr) into the first page, and receive_big() which then validates against an incorrect boundary calculation.
The operational impact of this vulnerability is severe as it allows for arbitrary code execution within the kernel space through a carefully crafted malicious packet. When a malicious virtio backend announces a packet length that falls within the validated gap, the page_to_skb() function processes the fragment chain incorrectly by walking beyond the allocated fragment array boundaries. This results in both an out-of-bounds write operation that stores a NULL page->private value into skb_shinfo()->frags[MAX_SKB_FRAGS], and the propagation of a NULL fragment through the receive path, which can cause kernel crashes or potentially enable privilege escalation attacks. The vulnerability specifically targets the kernel's networking subsystem and affects systems utilizing virtio network devices in virtualized environments.
This security flaw maps directly to CWE-129, which addresses improper validation of array index bounds, and aligns with ATT&CK technique T1068 by providing a path for privilege escalation through kernel memory corruption. The vulnerability demonstrates a classic case of incorrect bounds checking where the validation logic does not account for the actual memory layout and offset calculations performed by the receiving function. The fix implemented resolves this by tightening the length validation to match exactly the amount of data that add_recvbuf_big() actually advertises, eliminating the gap that allowed malicious input to bypass security checks. This remediation ensures that only legitimate packet lengths within the properly allocated buffer space can be processed, preventing both the out-of-bounds memory write and the NULL fragment propagation that could lead to system instability or exploitation.
The vulnerability highlights the importance of precise memory management in kernel drivers and demonstrates how seemingly minor offset calculations can create significant security implications. The fix requires careful attention to the exact memory layout and fragment chain construction within the virtio-net subsystem, ensuring that all validation checks correspond precisely to the actual memory regions being accessed. This type of vulnerability is particularly concerning in virtualized environments where malicious guest operating systems could exploit such flaws to escape containment and compromise the host system, making proper bounds checking essential for maintaining the security boundaries between virtual machines and their underlying infrastructure.