SECUFOCUSNOW
Home›CVE index›CVE-2026-64552
Review reviewHigh

CVE-2026-64552

Linux

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. page_to_s...

CVSS
8.4
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.28
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 8.4

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receive_big() receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. That is still too loose: add_recvbuf_big() sets sg[1] to start at offset sizeof(struct padded_vnet_hdr) into the first page, so the chain actually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the check allows for the common hdr_len == 12 case. A malicious virtio backend can announce a len in that gap. page_to_s...

Affected product and versions

Product
Linux
Affected versions
>= 82f9028e83944a9eee5229cbc6fee9be1de8a62d < f9451d0fd5ba635dcabb49bfe456a6db734a8986, >= 946dec89c41726b94d31147ec528b96af0be1b5a < 38e94d63e29f4a5c6eae87ee2c02101aaa321502, >= 82fe78065450d2d07f36a22e2b6b44955cf5ca5b < fbeb65154583879d556ea94cb2f15888e9470f3d, >= 0c716703965ffc5ef4311b65cb5d84a703784717 < c7fc9adf4e006155f7f2aeda052fbcde25cdcc49, >= 0c716703965ffc5ef4311b65cb5d84a703784717 < e6b8463b7d791f3886d7584259d6e9f06a69f12e, >= 0c716703965ffc5ef4311b65cb5d84a703784717 < 9e5ad06ea826322ce8c58b4a68442a96f600c3c4, >= 3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2, >= 6.1.159 < 6.1.178, >= 6.6.117 < 6.6.145, >= 6.12.58 < 6.12.97, >= 6.17.8 < 6.18, >= 6.18
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE
Not available
CVE-2026-64552 — Linux | SECUFOCUS NOW