CVE-2026-53199: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-53199 Overview

CVE-2026-53199 affects the Linux kernel's Hyper-V network virtual service client driver (hv_netvsc). The function netvsc_copy_to_send_buf() uses phys_to_virt() to translate page buffer entry PFNs when copying data into the VMBus send buffer. On 32-bit x86 systems built with CONFIG_HIGHMEM=y, skb fragment pages may reside above the LOWMEM boundary. The resulting address falls outside the kernel direct map, causing the subsequent memcpy() to fault on the transmit softirq path. The fault is fatal to the system. The Linux kernel maintainers resolved the issue by switching to kmap_local_page() and handling Hyper-V PFN granularity correctly.

Critical Impact
A kernel fault on the transmit softirq path triggers a fatal condition on affected 32-bit x86 Hyper-V guests, resulting in denial of service.

Affected Products

Linux kernel builds with the hv_netvsc driver enabled
32-bit x86 Linux guests running on Hyper-V with CONFIG_HIGHMEM=y
Systems where PAGE_SIZE > HV_HYP_PAGE_SIZE (e.g., arm64 with 64K pages) running as Hyper-V guests

Discovery Timeline

2026-06-25 - CVE CVE-2026-53199 published to NVD
2026-06-25 - Last updated in NVD database

Technical Details for CVE-2026-53199

Vulnerability Analysis

The defect resides in netvsc_copy_to_send_buf() within the hv_netvsc driver. This function copies page buffer entries into the VMBus send buffer used to transmit packets to the Hyper-V host. The Remote Network Driver Interface Specification (RNDIS) header and the skb linear data come from kmalloc'd memory and always live in the kernel direct map. Skb fragment entries, however, may reference page cache or user pages.

On 32-bit x86 with high memory enabled, those fragment pages can sit above the LOWMEM boundary. Calling phys_to_virt() on such a page returns an address that is not mapped, and the subsequent memcpy() faults in softirq context. Because the fault occurs on the transmit path with interrupts effectively disabled, recovery is not possible and the kernel terminates.

The copy path only handles packets smaller than the send section size (6,144 bytes by default). Larger packets follow the cp_partial path where only the RNDIS header is copied, so entries here are bounded by the section size.

Root Cause

The driver assumed all page buffer entries referenced direct-mapped kernel memory accessible via phys_to_virt(). This assumption breaks for highmem pages on 32-bit x86. A secondary issue exists where pb[i].pfn is a Hyper-V PFN at 4K granularity rather than a native PFN, and where pb[i].len can exceed PAGE_SIZE since commit 41a6328b2c55, which preserves contiguous PFN grouping in the page buffer array.

Attack Vector

The fault triggers on the transmit softirq path during normal network output. Any workload that produces skb fragments referencing highmem pages, such as sendfile() or zero-copy networking from page cache or user pages, can cause the kernel to fault. Triggering requires local activity on a vulnerable guest configuration, not a remote network request.

The vulnerability is described in prose only; refer to the upstream commits in the Linux kernel stable tree for the exact code changes.

Detection Methods for CVE-2026-53199

Indicators of Compromise

Kernel oops or panic messages referencing netvsc_copy_to_send_buf or hv_netvsc in the transmit softirq path
BUG: unable to handle page fault entries pointing to memcpy from net_tx_action or NAPI tx context
Unexpected guest VM reboots on 32-bit x86 Hyper-V hosts coinciding with network transmit activity

Detection Strategies

Inventory Linux guests on Hyper-V to identify 32-bit x86 builds with CONFIG_HIGHMEM=y and the hv_netvsc driver loaded.
Compare installed kernel versions against the fixed commits listed in the upstream Linux kernel stable tree.
Correlate guest crash events from Hyper-V host logs with kernel ring buffer captures forwarded to a central log store.

Monitoring Recommendations

Ship dmesg and kernel.log output to a centralized log platform and alert on stack traces involving netvsc_copy_to_send_buf.
Track guest uptime and unscheduled reboot counts for Hyper-V Linux VMs to surface kernel faults early.
Monitor Hyper-V integration component telemetry for abrupt VMBus disconnections from Linux guests.

How to Mitigate CVE-2026-53199

Immediate Actions Required

Update affected Linux guests to a kernel version that contains the kmap_local_page() fix for hv_netvsc.
Restart guest VMs after kernel upgrade to load the patched hv_netvsc module.
Prioritize patching for 32-bit x86 Hyper-V guests and any system where PAGE_SIZE > HV_HYP_PAGE_SIZE.

Patch Information

The Linux kernel maintainers replaced phys_to_virt() with kmap_local_page() in netvsc_copy_to_send_buf(). The patch reconstructs the physical address from the Hyper-V PFN, derives the native page, and copies page by page to handle entries that span multiple native pages. On non-highmem configurations, kmap_local_page() folds to page_address() and adds no overhead. Fix commits are available in the Linux kernel stable tree, with additional backports referenced at kernel.org commit 09b8a7aa and kernel.org commit fe7221b4.

Workarounds

Migrate workloads from 32-bit x86 Hyper-V guests to 64-bit x86_64 guests, which do not use highmem.
Rebuild affected kernels without CONFIG_HIGHMEM where the memory configuration permits.
Avoid zero-copy transmit paths that produce skb fragments from highmem pages until the kernel is patched.

bash

# Verify kernel version and hv_netvsc module on a Hyper-V Linux guest
uname -r
lsmod | grep hv_netvsc
# Check whether the running kernel was built with HIGHMEM
grep CONFIG_HIGHMEM /boot/config-$(uname -r)