In the Linux kernel, the following vulnerability has been resolved:

virtio-net: fix len check in receive_big()

receive_big() bounds the device-announced length by
(big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose:
add_recvbuf_big() sets sg[1] to start at offset
sizeof(struct padded_vnet_hdr) into the first page, so the chain
actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +
big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the
check allows for the common hdr_len == 12 case.

A malicious virtio backend can announce a len in that gap. page_to_skb()
then walks one frag past the page chain, storing a NULL page->private
into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds
write past the static frag array and a NULL frag handed up the rx path.

Bound len by the size add_recvbuf_big() actually advertised.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00144.

Key SSVC decision points have not yet been added.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions
Linux Linux unaffected
Version Status Constraints
82f9028e83944a9eee5229cbc6fee9be1de8a62d affected < f9451d0fd5ba635dcabb49bfe456a6db734a8986
946dec89c41726b94d31147ec528b96af0be1b5a affected < 38e94d63e29f4a5c6eae87ee2c02101aaa321502
82fe78065450d2d07f36a22e2b6b44955cf5ca5b affected < fbeb65154583879d556ea94cb2f15888e9470f3d
0c716703965ffc5ef4311b65cb5d84a703784717 affected < c7fc9adf4e006155f7f2aeda052fbcde25cdcc49
0c716703965ffc5ef4311b65cb5d84a703784717 affected < e6b8463b7d791f3886d7584259d6e9f06a69f12e
0c716703965ffc5ef4311b65cb5d84a703784717 affected < 9e5ad06ea826322ce8c58b4a68442a96f600c3c4
3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2 affected —
6.1.159 affected < 6.1.178
6.6.117 affected < 6.6.145
6.12.58 affected < 6.12.97
6.17.8 affected < 6.18
Linux Linux affected
Version Status Constraints
6.18 affected —
0 unaffected < 6.18
6.1.178 unaffected ≤ 6.1.*
6.6.145 unaffected ≤ 6.6.*
6.12.97 unaffected ≤ 6.12.*
6.18.40 unaffected ≤ 6.18.*
7.1.5 unaffected ≤ 7.1.*
7.2-rc1 unaffected ≤ *

No data.

No data.

OpenCVE Enrichment is a feature of OpenCVE that uses AI to automatically link vendors and products to CVEs. Learn more on GitHub.

Vendors Products
Linux Subscribe
Linux Kernel Subscribe

Project Subscriptions

Vendors Products
Linux Subscribe
Linux Kernel Subscribe
Advisories
Source ID Title
Debian DSA Debian DSA DSA-6405-1 linux security update
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
https://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502 cve-icon
https://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4 cve-icon
https://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49 cve-icon
https://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e cve-icon
https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986 cve-icon
https://git.kernel.org/stable/c/fbeb65154583879d556ea94cb2f15888e9470f3d cve-icon
https://lore.kernel.org/linux-cve-announce/2026072737-CVE-2026-64552-5e13@gregkh/T cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2026-64552 cve-icon
https://www.cve.org/CVERecord?id=CVE-2026-64552 cve-icon
History

Thu, 30 Jul 2026 06:15:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

 cvssV3_1

{'score': 8.4, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}

Wed, 29 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}

threat_severity

Important

Tue, 28 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-122
CWE-787

Mon, 27 Jul 2026 20:30:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. page_to_skb() then walks one frag past the page chain, storing a NULL page->private into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag handed up the rx path. Bound len by the size add_recvbuf_big() actually advertised.
Title virtio-net: fix len check in receive_big()
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Projects

Sign in to view the affected projects.

cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-07-30T06:06:44.048Z

Reserved: 2026-07-19T15:36:31.796Z

Link: CVE-2026-64552

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity : Important

Publid Date: 2026-07-27T00:00:00Z

Links: CVE-2026-64552 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-08-01T01:00:04Z

Weaknesses