CVE-2026-64550 Overview
CVE-2026-64550 is an out-of-bounds read vulnerability in the Linux kernel's Qualcomm rmnet (Remote Network Driver) subsystem. The flaw resides in rmnet_map_ingress_handler() within drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c. When ingress deaggregation is disabled, the handler forwards the socket buffer (skb) directly to __rmnet_map_ingress_handler() without validating the MAP (Multiplexing and Aggregation Protocol) frame length. The parser then dereferences the MAP header and checksum trailer using the on-wire pkt_len, causing a slab out-of-bounds read on short frames. The issue is reachable from local user context through interfaces such as tun, as demonstrated by a KASAN report.
Critical Impact
A local user with the ability to inject crafted frames into an rmnet-attached interface can trigger a kernel slab out-of-bounds read, leading to information disclosure, kernel memory corruption side effects, or denial of service.
Affected Products
- Linux kernel versions containing the Qualcomm rmnet driver prior to the fix commits
- Systems using drivers/net/ethernet/qualcomm/rmnet/ with ingress deaggregation disabled
- Distributions shipping vulnerable stable kernels referenced in the upstream patch series
Discovery Timeline
- 2026-07-27 - CVE-2026-64550 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64550
Vulnerability Analysis
The rmnet driver implements Qualcomm's MAP protocol used to multiplex multiple logical data streams over a single physical channel. Incoming frames traverse rmnet_rx_handler(), which invokes rmnet_map_ingress_handler(). Two ingress paths exist: an aggregated path that calls rmnet_map_deaggregate() and a non-aggregated path that passes the skb directly to __rmnet_map_ingress_handler().
The deaggregated path validates that skb->len is at least large enough to hold both the MAP header and the payload described by pkt_len. The non-aggregated path performs no such validation. As a result, rmnet_map_checksum_downlink_packet() reads the MAP checksum header and trailer beyond the buffer boundary when a truncated frame arrives. KASAN reports the slab-out-of-bounds read at rmnet_map_data.c:413.
Root Cause
The root cause is missing input validation on packet length before dereferencing protocol headers [CWE-125: Out-of-Bounds Read]. The parser trusts the attacker-controlled pkt_len field from the MAP header without confirming that skb->len contains enough bytes to satisfy the header, payload, and optional checksum trailer.
Attack Vector
A local attacker with permission to write to a TUN/TAP device attached to an rmnet interface can craft a MAP frame shorter than the length advertised in its own header. When the frame reaches __rmnet_map_ingress_handler() on the non-aggregated path, the driver reads memory past the allocation boundary. The KASAN trace in the advisory shows the path from tun_chr_write_iter() through netif_receive_skb() into rmnet_rx_handler(), confirming a local, low-privilege trigger.
The upstream fix factors the length check into a new helper, rmnet_map_validate_packet_len(), and calls it on both ingress paths. The MAP header bounds check runs first, since the non-aggregated path may receive frames shorter than the header itself.
Detection Methods for CVE-2026-64550
Indicators of Compromise
- KASAN slab-out-of-bounds warnings referencing rmnet_map_checksum_downlink_packet or __rmnet_map_ingress_handler in kernel logs.
- Unexpected kernel oops, panic, or dmesg entries originating from drivers/net/ethernet/qualcomm/rmnet/.
- Repeated short or malformed frames written to TUN/TAP devices bound to rmnet interfaces by non-root local processes.
Detection Strategies
- Monitor kernel ring buffer output for KASAN, BUG, or Oops entries with rmnet_ symbols in the stack trace.
- Audit systems for unpatched kernels that still include the pre-fix rmnet_map_ingress_handler() code path.
- Correlate local process activity writing to /dev/net/tun with subsequent kernel warnings on rmnet-enabled devices.
Monitoring Recommendations
- Forward journald and /var/log/kern.log events to a centralized logging platform and alert on kernel crash signatures.
- Track kernel package versions across the fleet to identify hosts running vulnerable builds referenced in the upstream commits.
- Enable audit rules on TUN/TAP device access to establish a baseline of legitimate users of rmnet-adjacent interfaces.
How to Mitigate CVE-2026-64550
Immediate Actions Required
- Apply the upstream stable kernel updates that introduce rmnet_map_validate_packet_len() on both ingress paths.
- Restrict access to /dev/net/tun and rmnet-attached interfaces to trusted users only.
- Disable the rmnet module on systems that do not require Qualcomm MAP support using modprobe -r rmnet or a blacklist entry.
Patch Information
The fix is distributed across multiple stable branches. Reference commits include Kernel Git Commit 00f4c36, Kernel Git Commit 14eb0c9, Kernel Git Commit 1b12612, Kernel Git Commit 231a8a4, Kernel Git Commit 3868c32, Kernel Git Commit a54d76d, Kernel Git Commit ed25bef, and Kernel Git Commit f0f1887. Rebuild the kernel or install distribution updates that incorporate these commits.
Workarounds
- Blacklist the rmnet module on hosts that do not require Qualcomm MAP multiplexing.
- Enforce mandatory access control policies (SELinux, AppArmor) restricting /dev/net/tun to authorized service accounts.
- Remove CAP_NET_ADMIN from unprivileged users and containers to prevent creation of TUN/TAP interfaces bound to rmnet.
# Configuration example: blacklist the rmnet module until patched
echo "blacklist rmnet" | sudo tee /etc/modprobe.d/blacklist-rmnet.conf
sudo rmmod rmnet 2>/dev/null || true
sudo update-initramfs -u
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
