CVE-2026-64527

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the drm/hyperv component where the hyperv receive sub() function processes VMBus packets without verifying the actual number of bytes written by the host into hv->recv buf. This allows a consumer waking on wait for completion timeout() to read up to 16 KiB of residue from previous messages as if it were the current response payload. Additionally, if vmbus recvpacket() returns -ENOBUFS, the reported length can exceed the buffer size, potentially leading to out-of-bounds read and write operations during memcpy() if the sub-handler is executed regardless of the return status. The vulnerability involves the handling of msg->vid hdr.type and specific message types including SYNTHVID VERSION RESPONSE, SYNTHVID RESOLUTION RESPONSE, SYNTHVID VRAM LOCATION ACK, and SYNTHVID FEATURE CHANGE.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.