{"id":"CVE-2026-64552","state":"PUBLISHED","title":"virtio-net: fix len check in receive_big()","description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix len check in receive_big()\n\nreceive_big() bounds the device-announced length by\n(big_packets_num_skbfrags + 1) * PAGE_SIZE.  That is still too loose:\nadd_recvbuf_big() sets sg[1] to start at offset\nsizeof(struct padded_vnet_hdr) into the first page, so the chain\nactually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +\nbig_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the\ncheck allows for the common hdr_len == 12 case.\n\nA malicious virtio backend can announce a len in that gap.  page_to_skb()\nthen walks one frag past the page chain, storing a NULL page->private\ninto skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds\nwrite past the static frag array and a NULL frag handed up the rx path.\n\nBound len by the size add_recvbuf_big() actually advertised.","publishedAt":"2026-07-27T20:10:40.570Z","updatedAt":"2026-10-19T20:48:40.599Z","severity":{"score":8.4,"label":"High","version":"3.1","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","source":"Linux"},"assigner":"Linux","products":["Linux Linux"],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"82f9028e83944a9eee5229cbc6fee9be1de8a62d","status":"affected","lessThan":"f9451d0fd5ba635dcabb49bfe456a6db734a8986","versionType":"git"},{"version":"946dec89c41726b94d31147ec528b96af0be1b5a","status":"affected","lessThan":"38e94d63e29f4a5c6eae87ee2c02101aaa321502","versionType":"git"},{"version":"82fe78065450d2d07f36a22e2b6b44955cf5ca5b","status":"affected","lessThan":"fbeb65154583879d556ea94cb2f15888e9470f3d","versionType":"git"},{"version":"0c716703965ffc5ef4311b65cb5d84a703784717","status":"affected","lessThan":"c7fc9adf4e006155f7f2aeda052fbcde25cdcc49","versionType":"git"},{"version":"0c716703965ffc5ef4311b65cb5d84a703784717","status":"affected","lessThan":"e6b8463b7d791f3886d7584259d6e9f06a69f12e","versionType":"git"},{"version":"0c716703965ffc5ef4311b65cb5d84a703784717","status":"affected","lessThan":"9e5ad06ea826322ce8c58b4a68442a96f600c3c4","versionType":"git"},{"version":"3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2","status":"affected","versionType":"git"},{"version":"6.1.159","status":"affected","lessThan":"6.1.178","versionType":"semver"},{"version":"6.6.117","status":"affected","lessThan":"6.6.145","versionType":"semver"},{"version":"6.12.58","status":"affected","lessThan":"6.12.97","versionType":"semver"},{"version":"6.17.8","status":"affected","lessThan":"6.18","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/virtio_net.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.18","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/virtio_net.c"]}],"references":["https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986","https://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502","https://git.kernel.org/stable/c/fbeb65154583879d556ea94cb2f15888e9470f3d","https://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49","https://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e","https://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4","https://cert-portal.siemens.com/productcert/html/ssa-019113.html","https://cert-portal.siemens.com/productcert/html/ssa-457936.html"],"weaknesses":["CWE-787"],"ingestedAt":"2026-10-29T20:12:41.951Z","source":{"repository":"CVEProject/cvelistV5","path":"cves/2026/64xxx/CVE-2026-64552.json","commit":"556c9d3a8cd17e218bb8e452ba7cd619a384ff47"},"raw":{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64552","state":"PUBLISHED","datePublished":"2026-07-27T20:10:40.570Z","dateUpdated":"2026-10-19T20:48:40.599Z","assignerShortName":"Linux","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateReserved":"2026-07-19T15:36:31.796Z"},"containers":{"cna":{"title":"virtio-net: fix len check in receive_big()","descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix len check in receive_big()\n\nreceive_big() bounds the device-announced length by\n(big_packets_num_skbfrags + 1) * PAGE_SIZE.  That is still too loose:\nadd_recvbuf_big() sets sg[1] to start at offset\nsizeof(struct padded_vnet_hdr) into the first page, so the chain\nactually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +\nbig_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the\ncheck allows for the common hdr_len == 12 case.\n\nA malicious virtio backend can announce a len in that gap.  page_to_skb()\nthen walks one frag past the page chain, storing a NULL page->private\ninto skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds\nwrite past the static frag array and a NULL frag handed up the rx path.\n\nBound len by the size add_recvbuf_big() actually advertised."}],"affected":[{"vendor":"Linux","product":"Linux","defaultStatus":"unaffected","versions":[{"version":"82f9028e83944a9eee5229cbc6fee9be1de8a62d","status":"affected","lessThan":"f9451d0fd5ba635dcabb49bfe456a6db734a8986","versionType":"git"},{"version":"946dec89c41726b94d31147ec528b96af0be1b5a","status":"affected","lessThan":"38e94d63e29f4a5c6eae87ee2c02101aaa321502","versionType":"git"},{"version":"82fe78065450d2d07f36a22e2b6b44955cf5ca5b","status":"affected","lessThan":"fbeb65154583879d556ea94cb2f15888e9470f3d","versionType":"git"},{"version":"0c716703965ffc5ef4311b65cb5d84a703784717","status":"affected","lessThan":"c7fc9adf4e006155f7f2aeda052fbcde25cdcc49","versionType":"git"},{"version":"0c716703965ffc5ef4311b65cb5d84a703784717","status":"affected","lessThan":"e6b8463b7d791f3886d7584259d6e9f06a69f12e","versionType":"git"},{"version":"0c716703965ffc5ef4311b65cb5d84a703784717","status":"affected","lessThan":"9e5ad06ea826322ce8c58b4a68442a96f600c3c4","versionType":"git"},{"version":"3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2","status":"affected","versionType":"git"},{"version":"6.1.159","status":"affected","lessThan":"6.1.178","versionType":"semver"},{"version":"6.6.117","status":"affected","lessThan":"6.6.145","versionType":"semver"},{"version":"6.12.58","status":"affected","lessThan":"6.12.97","versionType":"semver"},{"version":"6.17.8","status":"affected","lessThan":"6.18","versionType":"semver"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/virtio_net.c"]},{"vendor":"Linux","product":"Linux","defaultStatus":"affected","versions":[{"version":"6.18","status":"affected"},{"version":"0","status":"unaffected","lessThan":"6.18","versionType":"semver"},{"version":"6.1.178","status":"unaffected","lessThanOrEqual":"6.1.*","versionType":"semver"},{"version":"6.6.145","status":"unaffected","lessThanOrEqual":"6.6.*","versionType":"semver"},{"version":"6.12.97","status":"unaffected","lessThanOrEqual":"6.12.*","versionType":"semver"},{"version":"6.18.40","status":"unaffected","lessThanOrEqual":"6.18.*","versionType":"semver"},{"version":"7.1.5","status":"unaffected","lessThanOrEqual":"7.1.*","versionType":"semver"},{"version":"7.2","status":"unaffected","lessThanOrEqual":"*","versionType":"original_commit_for_fix"}],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["drivers/net/virtio_net.c"]}],"references":[{"url":"https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986"},{"url":"https://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502"},{"url":"https://git.kernel.org/stable/c/fbeb65154583879d556ea94cb2f15888e9470f3d"},{"url":"https://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49"},{"url":"https://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e"},{"url":"https://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4"}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","baseScore":8.4,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The malicious input is the buffer length announced by the virtio backend (hypervisor, vhost-user/VDUSE daemon, or virtio-net hardware device), not data from a network peer; a conforming backend can never announce a length in the vulnerable gap. This is the local device-to-driver attack surface, matching how other malicious-virtio-device bugs are scored.\nAC:L - The backend deterministically controls feature negotiation, MTU (hence big_packets_num_skbfrags), and the announced len, so it can force big-packets mode and hit the 20-byte gap on the first packet with no race or memory-layout luck.\nPR:N - The attacking backend requires no credentials or privileges inside the victim kernel — it is outside the guest's security authority and simply completes an RX descriptor. No guest-side account is needed.\nUI:N - Triggered automatically in the NAPI receive path as soon as the backend completes a receive buffer; no victim action is required.\nS:U - The corruption and crash are confined to the kernel that owns the virtio-net driver, with no crossing into a different security-managing authority such as an IOMMU or hypervisor boundary.\nC:H - A controlled 16-byte out-of-bounds write past skb_shared_info into an adjacent skb head in the NAPI page-frag cache lets the attacker corrupt neighbouring network buffer metadata, which is leverageable to disclose adjacent kernel memory; nr_frags is also left one past MAX_SKB_FRAGS so downstream code reads out-of-bounds frag state.\nI:H - This is an out-of-bounds write past the end of the static skb_shinfo()->frags[] array with attacker-influenced index and size, corrupting adjacent slab/page-frag memory — per guidance an OOB write is High and is potentially leverageable for control-flow hijack.\nA:H - After the OOB write, a NULL page is stored as a frag and immediately dereferenced via compound_head() in softirq context, producing a guaranteed kernel oops; the backend can repeat this at will."}]}],"providerMetadata":{"shortName":"Linux","orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","dateUpdated":"2026-08-17T04:57:29.862Z"},"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.1.159","versionEndExcluding":"6.1.178"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.6.117","versionEndExcluding":"6.6.145"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.12.58","versionEndExcluding":"6.12.97"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"6.18.40"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.1.5"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.18","versionEndExcluding":"7.2"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.17.8"}]}]}],"x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"affected":[{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIMATIC S7-1500 CPU 1518F-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.6","status":"affected","lessThan":"*","versionType":"custom"}]},{"vendor":"Siemens","product":"SIPLUS S7-1500 CPU 1518-4 PN/DP MFP","defaultStatus":"unknown","versions":[{"version":"V3.1.7","status":"affected","lessThan":"*","versionType":"custom"}]}],"references":[{"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"providerMetadata":{"shortName":"siemens-SADP","orgId":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","dateUpdated":"2026-10-15T01:23:55.064Z"},"x_adpType":"supplier"},{"title":"CISA ADP Vulnrichment","metrics":[{"other":{"type":"ssvc","content":{"id":"CVE-2026-64552","role":"CISA Coordinator","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"total"}],"version":"2.0.3","timestamp":"2026-10-16T15:42:28.527171Z"}}}],"problemTypes":[{"descriptions":[{"cweId":"CWE-787","lang":"en","type":"CWE","description":"CWE-787 Out-of-bounds Write"}]}],"providerMetadata":{"shortName":"CISA-ADP","orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","dateUpdated":"2026-10-19T20:48:40.599Z"}}]}}}