Skip to main content

Linux Kernel CVE-2026-64552

| EUVDEUVD-2026-49603 HIGH
2026-07-27 Linux GHSA-6c34-77j2-7g8c
Buffer Overflow Linux
8.4
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
8.4 HIGH
AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.0 HIGH

Backend-controlled device interface is modeled AV:L/PR:N and the gap is trivially hit (AC:L); primitive reliably corrupts/crashes the guest kernel (I:H/A:H) but the NULL-write leaks little (C:L).

3.1 AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H
4.0 AV:L/AC:L/AT:N/PR:N/UI:N/VC:L/VI:H/VA:H/SC:N/SI:N/SA:N
SUSE
6.7 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Red Hat
7.0 HIGH
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 30, 2026 - 06:54 vuln.today
CVSS changed
Jul 30, 2026 - 06:37 NVD
8.4 (HIGH)
Patch available
Jul 27, 2026 - 21:17 EUVD
CVE Published
Jul 27, 2026 - 20:10 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 27, 2026 - 20:10 cve.org
HIGH 8.4

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

virtio-net: fix len check in receive_big()

receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case.

A malicious virtio backend can announce a len in that gap. page_to_skb() then walks one frag past the page chain, storing a NULL page->private into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag handed up the rx path.

Bound len by the size add_recvbuf_big() actually advertised.

AnalysisAI

Out-of-bounds kernel write in the Linux virtio-net driver's receive_big() path allows a malicious or compromised virtio backend (host/hypervisor-side device emulator) to corrupt guest kernel memory. The length validation meant to bound device-announced packet size still permits a ~20-byte gap, so a crafted len drives page_to_skb() one fragment past the page chain, writing into skb_shinfo()->frags[MAX_SKB_FRAGS] and passing a NULL frag up the receive path. There is no public exploit identified at time of analysis and EPSS is low (0.17%), but the flaw carries a high CVSS (8.4) due to kernel-level memory corruption.

Technical ContextAI

The vulnerability lives in the virtio-net paravirtualized network driver used by Linux guests on KVM/QEMU and other virtio-capable hypervisors. In 'big packets' receive mode, add_recvbuf_big() lays out a scatter-gather chain where sg[1] begins at sizeof(struct padded_vnet_hdr) into the first page, so real capacity is hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE. receive_big() instead bounded len by (big_packets_num_skbfrags + 1) * PAGE_SIZE, over-counting by about 20 bytes for the common hdr_len==12 case. page_to_skb() then walks one fragment beyond the allocated chain, storing a NULL page->private into the fixed-size skb_shinfo frags array at index MAX_SKB_FRAGS. This is a classic CWE-787 out-of-bounds write (the input tags label it 'Buffer Overflow'); NVD lists CWE as N/A. The fix re-bounds len to the size add_recvbuf_big() actually advertised.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.1.178, 6.6.145, 6.12.97, 6.18.40, 7.1.5, or 7.2-rc1 (or later within each branch), per the kernel.org stable commits (https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986 and related). Distribution users should apply their vendor's kernel update mapping to these upstream commits. Where immediate patching is not possible, reduce exposure by ensuring guests only run on trusted hypervisors/backends, since exploitation requires control of the virtio backend; on hosts you administer, keep QEMU/hypervisor device emulation trusted and updated. As a configuration-level mitigation you can avoid virtio-net 'big packets' receive mode by ensuring mergeable receive buffers (VIRTIO_NET_F_MRG_RXBUF) or the relevant offload negotiation is enabled so the vulnerable receive_big() path is not used - the trade-off is a possible change in receive-buffer behavior/throughput and it depends on backend feature negotiation, so validate in your environment. Rebooting into the patched kernel is required for the fix to take effect.

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

CVE-2026-64552 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy