CVE-2026-64552

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the virtio-net component where the receive big() function uses an overly loose bound for the device-announced length. Specifically, the check allows for a length slightly larger than what is actually carried by the chain established in add recvbuf big(). A malicious virtio backend can exploit this gap by announcing a length that causes the page to skb() function to walk one fragment past the page chain. This results in an out-of-bounds write of a NULL page->private value into skb shinfo()->frags[MAX SKB FRAGS] and passes a NULL fragment up the receive path.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.