CVE-2026-64547

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the net1080 rx fixup() function where the packet len is not properly validated before accessing a pad byte. When packet len is even, the function reads from skb->data[packet len] before verifying if skb->len is different from packet len. Because packet len is only bounded against NC MAX PACKET, a malicious NetChip 1080 device can send a short frame with a large even packet len (such as 0x4000), causing a slab-out-of-bounds read past the end of the socket buffer (skb).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.