In the Linux kernel, the following vulnerability has been resolved:

net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

For an even packet_len, net1080_rx_fixup() reads the pad byte at
skb->data[packet_len] before the skb->len != packet_len check further
down, and packet_len is only bounded against NC_MAX_PACKET. A malicious
NetChip 1080 device can send a short frame advertising a large even
packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the
skb:

BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup
Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14
...
net1080_rx_fixup (drivers/net/usb/net1080.c:384)
usbnet_bh (drivers/net/usb/usbnet.c:1589)
process_one_work (kernel/workqueue.c:3322)
bh_worker (kernel/workqueue.c:3708)
tasklet_action (kernel/softirq.c:965)
handle_softirqs (kernel/softirq.c:622)
...

Reject the frame when packet_len >= skb->len before reading.

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00277.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
904813cd8a0b334189da285bb05af0b18b062502 affected < f42217fa7d535e9ec4151f7971f06f6ea65e850a
904813cd8a0b334189da285bb05af0b18b062502 affected < c087749815379e9af2fdbeb08bfc33870b103958
904813cd8a0b334189da285bb05af0b18b062502 affected < e4a87126c085b097d29e17e3b7647295bba8be7c
904813cd8a0b334189da285bb05af0b18b062502 affected < 685e92934f11d5e215dad58813e2f9955ac2f436
904813cd8a0b334189da285bb05af0b18b062502 affected < 4dc8484be3302d187274364820d3bef6c62bde32
904813cd8a0b334189da285bb05af0b18b062502 affected < b153cfe84b1340c69a13d0957665a2bfcf21239c
904813cd8a0b334189da285bb05af0b18b062502 affected < ea866cab12db1a2100b400a8b03569e5bc0ee29a
904813cd8a0b334189da285bb05af0b18b062502 affected < 03f384bc0cb8d4a1301d4f5b0baef2d980258383
Linux Linux affected
Version Status Constraints
2.6.14 affected —
0 unaffected < 2.6.14
5.10.261 unaffected ≤ 5.10.*
5.15.212 unaffected ≤ 5.15.*
6.1.178 unaffected ≤ 6.1.*
6.6.145 unaffected ≤ 6.6.*
6.12.97 unaffected ≤ 6.12.*
6.18.40 unaffected ≤ 6.18.*
7.1.5 unaffected ≤ 7.1.*
7.2-rc3 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories
Source ID Title
Debian DSA Debian DSA DSA-6405-1 linux security update
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/03f384bc0cb8d4a1301d4f5b0baef2d980258383 cve-icon
https://git.kernel.org/stable/c/4dc8484be3302d187274364820d3bef6c62bde32 cve-icon
https://git.kernel.org/stable/c/685e92934f11d5e215dad58813e2f9955ac2f436 cve-icon
https://git.kernel.org/stable/c/b153cfe84b1340c69a13d0957665a2bfcf21239c cve-icon
https://git.kernel.org/stable/c/c087749815379e9af2fdbeb08bfc33870b103958 cve-icon
https://git.kernel.org/stable/c/e4a87126c085b097d29e17e3b7647295bba8be7c cve-icon
https://git.kernel.org/stable/c/ea866cab12db1a2100b400a8b03569e5bc0ee29a cve-icon
https://git.kernel.org/stable/c/f42217fa7d535e9ec4151f7971f06f6ea65e850a cve-icon
https://lore.kernel.org/linux-cve-announce/2026072736-CVE-2026-64547-4deb@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-64547 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-64547 cve-icon
History

Thu, 30 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

 cvssV3_1

{'score': 8.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}

Wed, 29 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References
Metrics threat_severity

None

 cvssV3_1

{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}

threat_severity

Moderate

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pad-byte access in rx_fixup For an even packet_len, net1080_rx_fixup() reads the pad byte at skb->data[packet_len] before the skb->len != packet_len check further down, and packet_len is only bounded against NC_MAX_PACKET. A malicious NetChip 1080 device can send a short frame advertising a large even packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the skb: BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14 ... net1080_rx_fixup (drivers/net/usb/net1080.c:384) usbnet_bh (drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3708) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) ... Reject the frame when packet_len >= skb->len before reading.
Title net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-30T06:06:39.748Z

Reserved: 2026-07-19T15:36:31.795Z

Link: CVE-2026-64547

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Moderate

Publid Date: 2026-07-27T00:00:00Z

Links: CVE-2026-64547 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-02T10:45:03Z

Weaknesses