Strix
26.1K

CVE-2026-64552

HIGHCVSS 8.4/10EPSS 0.17%

Last modified

CVE-2026-64552 is a high-severity vulnerability rated 8.4/10 on the CVSS scale. In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. EPSS estimates a 0.17% chance of exploitation in the next 30 days.

Description

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. page_to_skb() then walks one frag past the page chain, storing a NULL page->private into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag handed up the rx path. Bound len by the size add_recvbuf_big() actually advertised.

Metrics

CVSS 3.1
8.4/10

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Probability
0.17%

6.9th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

Source: CNA advisory (CVE.org). NVD analysis pending.

VendorProductVersions
LinuxLinux>= 82f9028e83944a9eee5229cbc6fee9be1de8a62d, < f9451d0fd5ba635dcabb49bfe456a6db734a8986; >= 946dec89c41726b94d31147ec528b96af0be1b5a, < 38e94d63e29f4a5c6eae87ee2c02101aaa321502; >= 82fe78065450d2d07f36a22e2b6b44955cf5ca5b, < fbeb65154583879d556ea94cb2f15888e9470f3d; >= 0c716703965ffc5ef4311b65cb5d84a703784717, < c7fc9adf4e006155f7f2aeda052fbcde25cdcc49; >= 0c716703965ffc5ef4311b65cb5d84a703784717, < e6b8463b7d791f3886d7584259d6e9f06a69f12e; >= 0c716703965ffc5ef4311b65cb5d84a703784717, < 9e5ad06ea826322ce8c58b4a68442a96f600c3c4; 3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2; >= 6.1.159, < 6.1.178; >= 6.6.117, < 6.6.145; >= 6.12.58, < 6.12.97; >= 6.17.8, < 6.18
LinuxLinux6.18

References

Timeline

Published
Last Modified
Status
Received

Frequently Asked Questions

What is CVE-2026-64552?
In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. page_to_skb() then walks one frag past the page chain, storing a NULL page->private into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag handed up the rx path. Bound len by the size add_recvbuf_big() actually advertised.
How severe is CVE-2026-64552?
CVE-2026-64552 has a CVSS score of 8.4/10 (HIGH severity). The EPSS model estimates a 0.17% probability of exploitation in the next 30 days.
How do I fix CVE-2026-64552?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

How Strix Helps

Related CVEs from 2026

View all 2026CVEs →

Are you affected by CVE-2026-64552?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST