{"affected":[],"cveId":"CVE-2026-64552","cwes":["CWE-787"],"description":"In the Linux kernel, the following vulnerability has been resolved:\n\nvirtio-net: fix len check in receive_big()\n\nreceive_big() bounds the device-announced length by\n(big_packets_num_skbfrags + 1) * PAGE_SIZE.  That is still too loose:\nadd_recvbuf_big() sets sg[1] to start at offset\nsizeof(struct padded_vnet_hdr) into the first page, so the chain\nactually carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) +\nbig_packets_num_skbfrags * PAGE_SIZE bytes -- 20 bytes less than the\ncheck allows for the common hdr_len == 12 case.\n\nA malicious virtio backend can announce a len in that gap.  page_to_skb()\nthen walks one frag past the page chain, storing a NULL page->private\ninto skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds\nwrite past the static frag array and a NULL frag handed up the rx path.\n\nBound len by the size add_recvbuf_big() actually advertised.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":8.4,"severity":"high","source":"NVD: 416baaa9-dc9f-4396-8d5f-8c081fb06d67","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","version":"3.1"}],"modifiedAt":1793729739353,"publishedAt":1785187028173,"references":[{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986"},{"source":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","tags":[],"url":"https://git.kernel.org/stable/c/fbeb65154583879d556ea94cb2f15888e9470f3d"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-019113.html"},{"source":"0b142b55-0307-4c5a-b3c9-f314f3fb7c5e","tags":[],"url":"https://cert-portal.siemens.com/productcert/html/ssa-457936.html"}],"remediation":[],"revision":"ab007223137c2c6737998e0dd73b59c44249058c9456615cc4b6639822b832e9","sources":[{"modifiedAt":1793729739353,"name":"NVD","retrievedAt":1793729784406,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-64552"}],"ssvc":{"assessedAt":1792165348527,"automatable":"no","exploitation":"none","source":"NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0","technicalImpact":"total"},"status":"published","title":"CVE-2026-64552","updatedAt":1793729784406}