CVE-2026-64547: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64547 Overview

CVE-2026-64547 is an out-of-bounds read vulnerability in the Linux kernel net1080 USB network driver. The flaw resides in net1080_rx_fixup() inside drivers/net/usb/net1080.c. The function reads a pad byte at skb->data[packet_len] before validating that packet_len falls within skb->len. Because packet_len is only bounded against NC_MAX_PACKET, a malicious NetChip 1080 USB device can advertise a large even packet_len (for example, 0x4000) in a short frame and force the driver to read past the socket buffer. KASAN reports a slab-out-of-bounds read of size 1 during softirq processing.

Critical Impact
A malicious or compromised USB device on an adjacent bus can trigger kernel out-of-bounds reads, leading to information disclosure or kernel panic and denial of service.

Affected Products

Linux kernel builds shipping the net1080 USB Ethernet driver (drivers/net/usb/net1080.c)
Distributions and stable branches prior to the fixes referenced in the upstream commits
Systems that permit attachment of NetChip 1080 USB networking devices

Discovery Timeline

2026-07-27 - CVE-2026-64547 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64547

Vulnerability Analysis

The net1080_rx_fixup() function processes incoming frames from NetChip 1080 USB Ethernet adapters. For even values of packet_len, the function accesses a trailing pad byte at offset skb->data[packet_len] before performing the sanity check that compares skb->len against packet_len. The only prior bound applied to packet_len is a comparison with NC_MAX_PACKET, which permits large values such as 0x4000.

When a hostile device sends a short USB frame that advertises an inflated even packet_len, the pad-byte read dereferences memory outside the allocated skb buffer. KASAN traces show the fault path traverses usbnet_bh, process_one_work, bh_worker, and tasklet_action under ksoftirqd. The out-of-bounds access can leak adjacent slab contents into driver logic or corrupt scheduling by triggering a kernel oops.

Root Cause

The root cause is missing input validation [Out-of-Bounds Read] on attacker-controlled length metadata from a USB peripheral. The driver trusts the packet_len header field for indexing before verifying it against the actual skb->len, violating check-before-use ordering.

Attack Vector

Exploitation requires physical or logical adjacency: an attacker must present a rogue USB device (or a device emulator such as Raspberry Pi Zero acting as a NetChip 1080) to the target host. Once bound to the net1080 driver, the device transmits a crafted short frame whose header declares a large even packet_len. No user authentication is required, and the vulnerable code path executes in softirq context.

No public proof-of-concept exploit code is available. See the upstream commits listed in Kernel Git Commit 03f384bc and Kernel Git Commit e4a87126 for the corrected boundary check.

Detection Methods for CVE-2026-64547

Indicators of Compromise

KASAN slab-out-of-bounds reports referencing net1080_rx_fixup in kernel logs
Unexpected kernel oops or panic traces containing usbnet_bh and net1080 frames
dmesg entries showing binding of the net1080 driver to newly attached USB devices in sensitive environments

Detection Strategies

Enable KASAN on test and canary hosts to surface out-of-bounds reads in USB network drivers before they reach production
Alert on kernel ring buffer entries containing net1080_rx_fixup or unexpected usbnet slab access faults
Monitor USB device enumeration events for NetChip 1080 vendor and product IDs on endpoints where such hardware is not authorized

Monitoring Recommendations

Forward /var/log/kern.log, journald, and auditd USB events to a central log platform for anomaly analysis
Correlate USB attach events with subsequent kernel warnings or crashes on the same host within a short time window
Track kernel package versions across the fleet and flag hosts still running builds prior to the referenced stable commits

How to Mitigate CVE-2026-64547

Immediate Actions Required

Apply the upstream kernel patches referenced by the stable commits, or upgrade to a distribution kernel that incorporates them
Restrict USB device attachment on servers and endpoints using USBGuard or equivalent allowlisting
Blacklist the net1080 module on systems that do not require NetChip 1080 hardware

Patch Information

The fix adds a packet_len >= skb->len rejection before the pad-byte access. Corrected code is available in the stable tree via Kernel Git Commit 03f384bc, Kernel Git Commit 4dc8484b, Kernel Git Commit 685e9293, Kernel Git Commit b153cfe8, Kernel Git Commit c0877498, Kernel Git Commit e4a87126, Kernel Git Commit ea866cab, and Kernel Git Commit f42217fa.

Workarounds

Blacklist the module by adding blacklist net1080 to /etc/modprobe.d/blacklist-net1080.conf and rebuilding the initramfs
Disable unused USB ports through firmware or physical port blockers in high-assurance environments
Enforce USB device allowlisting policies with USBGuard to prevent attachment of unauthorized NetChip 1080 devices

bash

# Configuration example
echo 'blacklist net1080' | sudo tee /etc/modprobe.d/blacklist-net1080.conf
sudo depmod -a
sudo update-initramfs -u

# Verify the module is not loaded
lsmod | grep net1080