Skip to main content

Linux Kernel CVE-2026-64550

| EUVDEUVD-2026-49601 HIGH
2026-07-27 Linux GHSA-wpm4-rcr2-x634
Buffer Overflow Qualcomm Linux
7.3
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.3 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
vuln.today AI
7.3 HIGH

Local frame injection by a low-privileged user (AV:L/PR:L), no user interaction, causing kernel memory disclosure (C:H) and potential panic (A:H); integrity impact limited.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:L/VA:H/SC:N/SI:N/SA:N
SUSE
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
Low
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 30, 2026 - 06:52 vuln.today
CVSS changed
Jul 30, 2026 - 06:37 NVD
7.3 (HIGH)
Patch available
Jul 27, 2026 - 21:17 EUVD
CVE Published
Jul 27, 2026 - 20:10 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 27, 2026 - 20:10 cve.org
HIGH 7.3

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: validate MAP frame length before ingress parsing

When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handler(), skipping the length validation that rmnet_map_deaggregate() performs on the aggregated path. The parser then dereferences the MAP header and csum header/trailer based on the on-wire pkt_len without checking skb->len, so a short frame is read out of bounds:

BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet Read of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: ... rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413) __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089) netif_receive_skb (net/core/dev.c:6460) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2001) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ...

Factor that validation out of rmnet_map_deaggregate() into rmnet_map_validate_packet_len() and run it on the no-aggregation path too. The MAP header is bounds-checked first, since this path can receive a frame shorter than the header.

AnalysisAI

Out-of-bounds read in the Qualcomm rmnet (Rmnet Multiplexing and Aggregation Protocol) driver of the Linux kernel allows a local attacker to read kernel slab memory beyond frame boundaries by injecting a short MAP frame while ingress deaggregation is disabled. The no-aggregation ingress path skipped the length validation performed on the aggregated path, so the parser dereferenced the MAP header and checksum trailer using the on-wire pkt_len without verifying skb->len. No public exploit has been identified at time of analysis, and the low EPSS score (0.18%, 7th percentile) reflects the local-only, niche-driver nature of the flaw rather than widespread mass exploitation.

Technical ContextAI

The affected component is the rmnet driver (drivers/net/ethernet/qualcomm/rmnet) used for the Qualcomm MAP (Multiplexing and Aggregation Protocol) that carries cellular modem traffic over multiplexed logical channels. On the normal path, rmnet_map_deaggregate() validates that the socket buffer actually contains the number of bytes advertised in the MAP header's pkt_len field before the checksum-offload code (rmnet_map_checksum_downlink_packet at rmnet_map_data.c:413) reads the header and CSUM trailer. When deaggregation is disabled, rmnet_map_ingress_handler() bypassed that check and handed the skb directly to __rmnet_map_ingress_handler(), so a frame shorter than the declared header/payload caused a slab-out-of-bounds read (a CWE-125 out-of-bounds read; the supplied CWE field is N/A but the KASAN trace and 'Buffer Overflow' tag confirm the class). The fix factors the check into rmnet_map_validate_packet_len() and runs it on both paths, bounds-checking the MAP header first because this path can legitimately receive sub-header-length frames.

RemediationAI

Vendor-released patch: upgrade to a fixed stable kernel - 5.10.261, 5.15.212, 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5 or 7.2-rc3 or later on the corresponding branch - which adds rmnet_map_validate_packet_len() to the no-aggregation ingress path; the fix commits are available at https://git.kernel.org/stable/c/ (for example a54d76d176e50d2fdbd39b7231efe256170339e4 and ed25befc8c36f896b5878f9078faddb67fd7e2d0). Where immediate patching is not possible, reduce exposure by not loading the rmnet driver on systems that do not require Qualcomm MAP functionality (blacklist the module), which fully removes the attack surface but disables rmnet-based cellular multiplexing; alternatively restrict which local users can create or write to tun/rmnet interfaces (CAP_NET_ADMIN and device permissions), which limits the low-privilege injection vector at the cost of tightening network-management access. Because impact is confined to hosts that actually run rmnet, unaffected general-purpose systems need no action beyond routine kernel updates.

More in Qualcomm

View all
CVE-2013-2597 HIGH
8.4 Aug 31

Stack-based buffer overflow in the acdb_ioctl function in audio_acdb.c in the acdb audio driver for the Linux kernel 2.6
CVE-2014-10031 HIGH POC
7.5 Jan 13

Buffer overflow in the IMAPd service in Qualcomm Eudora WorldMail 9.0.333.0 allows remote attackers to execute arbitrary
CVE-2020-11117 CRITICAL POC
9.8 Sep 08

u'In the lbd service, an external user can issue a specially crafted debug command to overwrite arbitrary files with arb
CVE-2016-5348 MEDIUM POC
5.9 Oct 10

The GPS component in Android 4.x before 4.4.4, 5.0.x before 5.0.2, 5.1.x before 5.1.1, 6.x before 2016-10-01, and 7.0 be
CVE-2014-4322 HIGH POC
7.2 Dec 24

drivers/misc/qseecom.c in the QSEECOM driver for the Linux kernel 3.x, as used in Qualcomm Innovation Center (QuIC) Andr
CVE-2015-0569 HIGH POC
7.8 May 09

Heap-based buffer overflow in the private wireless extensions IOCTL implementation in wlan_hdd_wext.c in the WLAN (aka W
CVE-2017-8260 HIGH POC
7.8 Aug 18

In all Qualcomm products with Android releases from CAF using the Linux kernel, due to a type downcast, a value may impr
CVE-2016-3934 HIGH POC
7.8 Oct 10

drivers/media/platform/msm/camera_v2/sensor/io/msm_camera_cci_i2c.c in the Qualcomm camera driver in Android before 2016
CVE-2020-11207 HIGH POC
7.8 Nov 12

Buffer overflow in LibFastCV library due to improper size checks with respect to buffer length' in Snapdragon Auto, Snap
CVE-2020-11206 HIGH POC
7.8 Nov 12

Possible buffer overflow in Fastrpc while handling received parameters due to lack of validation on input parameters' in
CVE-2020-11202 HIGH POC
7.8 Nov 12

Buffer overflow/underflow occurs when typecasting the buffer passed by CPU internally in the library which is not aligne
CVE-2020-11201 HIGH POC
7.8 Nov 12

Arbitrary access to DSP memory due to improper check in loaded library for data received from CPU side' in Snapdragon Au

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64550 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy