{"cve":"CVE-2026-64552","nvd":{"published":"2026-07-27T21:17:08.173","modified":"2026-10-19T21:17:45.313","status":"Received","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix len check in receive_big()\n\nreceive_big() bounds the device-announced length by\n(big_packets_num_skbfrags + 1) * PAGE_SIZE.  That is still too loose:\nadd_recvbuf_big() sets sg[1] to start at offset\nsizeof(struct padded_vnet_hdr) into the first page, so the chain\nactually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +\nbig_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the\ncheck allows for the common hdr_len == 12 case.\n\nA malicious virtio backend can announce a len in that gap.  page_to_skb()\nthen walks one frag past the page chain, storing a NULL page->private\ninto skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds\nwrite past the static frag array and a NULL frag handed up the rx path.\n\nBound len by the size add_recvbuf_big() actually advertised.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":8.4},"cwes":["CWE-787"],"references":["https://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502","https://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4","https://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49","https://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e","https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986"],"products":[],"source":"nvd","synced_at":"2026-10-21T03:56:58.798400159+00:00"},"epss":{"cve":"CVE-2026-64552","score":0.00142,"percentile":0.0351,"date":"2026-10-25"},"kev":null,"osv":[],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}