Linux Kernel virtio-net OOB Write via len Check in recv_big()
CVE-2026-64552 Published on July 27, 2026
virtio-net: fix len check in receive_big()
In the Linux kernel, the following vulnerability has been resolved:
virtio-net: fix len check in receive_big()
receive_big() bounds the device-announced length by
(big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose:
add_recvbuf_big() sets sg[1] to start at offset
sizeof(struct padded_vnet_hdr) into the first page, so the chain
actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +
big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the
check allows for the common hdr_len == 12 case.
A malicious virtio backend can announce a len in that gap. page_to_skb()
then walks one frag past the page chain, storing a NULL page->private
into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds
write past the static frag array and a NULL frag handed up the rx path.
Bound len by the size add_recvbuf_big() actually advertised.
Products Associated with CVE-2026-64552
Want to know whenever a new CVE is published for Linux Kernel? stack.watch will email you.
Affected Versions
Linux:- Version 82f9028e83944a9eee5229cbc6fee9be1de8a62d and below f9451d0fd5ba635dcabb49bfe456a6db734a8986 is affected.
- Version 946dec89c41726b94d31147ec528b96af0be1b5a and below 38e94d63e29f4a5c6eae87ee2c02101aaa321502 is affected.
- Version 82fe78065450d2d07f36a22e2b6b44955cf5ca5b and below fbeb65154583879d556ea94cb2f15888e9470f3d is affected.
- Version 0c716703965ffc5ef4311b65cb5d84a703784717 and below c7fc9adf4e006155f7f2aeda052fbcde25cdcc49 is affected.
- Version 0c716703965ffc5ef4311b65cb5d84a703784717 and below e6b8463b7d791f3886d7584259d6e9f06a69f12e is affected.
- Version 0c716703965ffc5ef4311b65cb5d84a703784717 and below 9e5ad06ea826322ce8c58b4a68442a96f600c3c4 is affected.
- Version 3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2 is affected.
- Version 6.1.159 and below 6.1.178 is affected.
- Version 6.6.117 and below 6.6.145 is affected.
- Version 6.12.58 and below 6.12.97 is affected.
- Version 6.17.8 and below 6.18 is affected.
- Version 6.18 is affected.
- Before 6.18 is unaffected.
- Version 6.1.178, <= 6.1.* is unaffected.
- Version 6.6.145, <= 6.6.* is unaffected.
- Version 6.12.97, <= 6.12.* is unaffected.
- Version 6.18.40, <= 6.18.* is unaffected.
- Version 7.1.5, <= 7.1.* is unaffected.
- Version 7.2-rc1, <= * is unaffected.