CVE-2026-64550

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the Qualcomm rmnet driver where the system fails to validate MAP frame length before ingress parsing when ingress deaggregation is disabled. In this scenario, the rmnet map ingress handler() function passes the socket buffer (skb) directly to rmnet map ingress handler(), bypassing the length validation typically performed by rmnet map deaggregate(). Consequently, the parser dereferences the MAP header and checksum header/trailer based on the on-wire pkt len without verifying skb->len, leading to an out-of-bounds read of short frames. This is specifically observed in the rmnet map checksum downlink packet() function.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.