CVE-2026-64527: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64527 Overview

CVE-2026-64527 is a Linux kernel vulnerability in the drm/hyperv graphics driver. The hyperv_receive_sub() function dispatched VMBus packets without validating how many bytes the Hyper-V host wrote into the receive buffer. The completion path then copied a fixed VMBUS_MAX_PACKET_SIZE (16 KiB) into hv->init_buf, allowing residue from prior messages to be consumed as if it were the response payload. The patch adds strict packet-size validation and gates the copy on a successful vmbus_recvpacket() return, preventing reads and writes past the 16 KiB buffers.

Critical Impact
Guest kernels running the Hyper-V DRM driver could consume stale or attacker-controlled buffer contents, enabling information disclosure or out-of-bounds memory access when handling malformed VMBus messages.

Affected Products

Linux kernel with the drm/hyperv driver enabled
Hyper-V guest virtual machines using the synthetic video device
Distributions shipping vulnerable kernels prior to the referenced stable commits

Discovery Timeline

2026-07-25 - CVE-2026-64527 published to NVD
2026-07-25 - Last updated in NVD database

Technical Details for CVE-2026-64527

Vulnerability Analysis

The flaw resides in hyperv_receive_sub() within the Hyper-V DRM driver. The function read msg->vid_hdr.type and dispatched into one of four message-type branches without verifying the byte count reported by the host. The completion path invoked memcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), causing consumers waiting on wait_for_completion_timeout() to potentially read up to 16 KiB of residue from a prior message as a legitimate response payload.

A second failure mode existed in the return-value handling of vmbus_recvpacket(). On -ENOBUFS, the function reports the required length rather than the bytes received. This value can exceed hv->recv_buf, so an unconditional copy of bytes_recvd would read and write past the 16 KiB buffers.

Root Cause

The driver trusted the message contents without enforcing a minimum size covering the pipe and synthvid header. For SYNTHVID_RESOLUTION_RESPONSE, which is variable length, the driver did not validate the fixed prefix before reading resolution_count, nor bound that count against the SYNTHVID_MAX_RESOLUTION_COUNT array. Combined with the copy path executing on failed receives, the driver could operate on uninitialized or oversized buffers.

Attack Vector

A malicious or compromised Hyper-V host, or any code path capable of injecting malformed VMBus packets to a guest, could deliver undersized or malformed synthetic video messages. The guest kernel would then treat prior buffer residue as response payload, resulting in out-of-bounds reads and use of uninitialized data during driver completion handling. Details of the fix are available in the referenced kernel stable commits.

No verified public exploit code is available. The vulnerability is described in prose per the upstream commit message.

Detection Methods for CVE-2026-64527

Indicators of Compromise

Kernel log entries produced by drm_err_ratelimited() reporting rejected VMBus packets from the Hyper-V DRM driver after patching.
Unexpected hyperv_drm warnings or synthetic video initialization failures in Hyper-V guests.
Anomalous VMBus channel traffic patterns targeting the synthetic video device in guest telemetry.

Detection Strategies

Inventory guest kernels running under Hyper-V and identify hosts running kernel versions prior to the fixed stable releases referenced by the upstream commits.
Correlate kernel dmesg output for drm/hyperv warnings against baseline behavior on healthy guests.
Monitor for guest crashes, memory corruption reports, or KASAN splats tied to the hyperv_drm module.

Monitoring Recommendations

Forward guest kernel logs to a centralized log store and alert on drm_err_ratelimited messages from the Hyper-V DRM path.
Track kernel version drift across the Hyper-V guest fleet to confirm patch adoption.
Enable KASAN in test environments to surface out-of-bounds reads during driver fuzzing.

How to Mitigate CVE-2026-64527

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits 049a6b47, 164dc7bf, 57d5d697, 588c84b4, 7f87763f, c8974d96, and f5251226.
Update Hyper-V guest kernels to a distribution build that incorporates the fix.
Reboot affected guests after patching to load the corrected hyperv_drm module.

Patch Information

The fix passes bytes_recvd into hyperv_receive_sub() and rejects packets that do not cover the pipe and synthvid header. A switch on msg->vid_hdr.type computes the type-specific payload size, and the sub-handler runs only when vmbus_recvpacket() returned success. Rejected packets are logged via drm_err_ratelimited(). Patch details are available in the Linux kernel stable tree.

Workarounds

If patching is delayed, disable the hyperv_drm module on guests that do not require accelerated synthetic video output and fall back to a text or basic framebuffer console.
Restrict guest workloads to trusted Hyper-V hosts and reduce exposure of Hyper-V guests to untrusted operators.
Snapshot and monitor guest kernels for stability regressions until the fixed kernel is rolled out fleet-wide.

bash

# Verify installed kernel version and hyperv_drm module status
uname -r
lsmod | grep hyperv_drm

# Temporarily blacklist the module if patching is delayed
echo "blacklist hyperv_drm" | sudo tee /etc/modprobe.d/blacklist-hyperv-drm.conf
sudo update-initramfs -u