|
ELS
< Back

CVE-2026-64550

Updated on 27 Jul 2026

Severity

7.3 High severity

Details

CVSS score
7.3
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Links
NISTCIRCLRHELUbuntu

Overview

About vulnerability

In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: validate MAP frame length before ingress parsing

When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handler(), skipping the length validation that rmnet_map_deaggregate() performs on the aggregated path. The parser then dereferences the MAP header and csum header/trailer based on the on-wire pkt_len without checking skb->len, so a short frame is read out of bounds:

BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet Read of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: … rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413) __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089) netif_receive_skb (net/core/dev.c:6460) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2001) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:94) …

Factor that validation out of rmnet_map_deaggregate() into rmnet_map_validate_packet_len() and run it on the no-aggregation path too. The MAP header is bounds-checked first, since this path can receive a frame shorter than the header.

Details

Affected product:
Debian 10 ELS , Debian 11 ELS , Ubuntu 18.04 ELS , Ubuntu 20.04 ELS
Affected packages:
linux @ 5.4.0 (+3 more)

Fixes

KernelCare state

Live-patch status from KernelCare for each operating system.

Operating system Status Covered kernels
Debian 11 Will Not Fix
44 kernels
  • 5.10.46-5
  • 5.10.70-1
  • 5.10.46-4
  • 5.10.84-1
  • 5.10.92-1
  • 5.10.92-2
  • 5.10.103-1
  • 5.10.106-1
  • 5.10.113-1
  • 5.10.120-1
  • 5.10.127-1
  • 5.10.127-2
  • 5.10.136-1
  • 5.10.140-1
  • 5.10.149-1
  • 5.10.149-2
  • 5.10.158-2
  • 5.10.162-1
  • 5.10.179-1
  • 5.10.179-2
  • 5.10.179-3
  • 5.10.179-5
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.178-3
  • 5.10.205-2
  • 5.10.205-1
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
  • 5.10.247-1
  • 5.10.249-1
  • 5.10.251-1
  • 5.10.251-3
  • 5.10.251-4
  • 5.10.251-5
  • 5.10.257-1
  • 5.10.259-1
Debian 11 cloud Will Not Fix
24 kernels
  • 5.10.113-1
  • 5.10.179-2
  • 5.10.179-3
  • 5.10.179-5
  • 5.10.191-1
  • 5.10.197-1
  • 5.10.205-2
  • 5.10.209-2
  • 5.10.216-1
  • 5.10.218-1
  • 5.10.221-1
  • 5.10.223-1
  • 5.10.226-1
  • 5.10.234-1
  • 5.10.237-1
  • 5.10.244-1
  • 5.10.247-1
  • 5.10.249-1
  • 5.10.251-1
  • 5.10.251-3
  • 5.10.251-4
  • 5.10.251-5
  • 5.10.257-1
  • 5.10.259-1
Debian 12 Planned —
Debian 13 Will Not Fix
13 kernels
  • 6.12.85-1
  • 6.12.86-1
  • 6.12.88-1
  • 6.12.74-2
  • 6.12.73-1
  • 6.12.63-1
  • 6.12.69-1
  • 6.12.74-1
  • 6.12.90-1
  • 6.12.90-2
  • 6.12.94-1
  • 6.12.95-1
  • 6.12.96-1