CVE-2026-64552: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64552 Overview

CVE-2026-64552 is a Linux kernel vulnerability in the virtio-net driver. The flaw resides in the receive_big() function, which enforces an insufficient bounds check on device-announced packet lengths. A malicious virtio backend can announce a length that fits inside a 20-byte gap between the actual buffer size and the checked bound. This causes page_to_skb() to walk one fragment past the page chain, producing an out-of-bounds write into skb_shinfo()->frags[MAX_SKB_FRAGS] and pushing a NULL fragment up the receive path. The bug affects guests running on untrusted or compromised virtio hosts and impacts confidentiality, integrity, and availability at the guest kernel level.

Critical Impact
A malicious virtio backend can trigger an out-of-bounds write in the guest kernel's socket buffer fragment array, enabling potential memory corruption and kernel-level compromise of the guest.

Affected Products

Linux kernel virtio-net driver (versions prior to the fix commits listed under Patch Information)
Guest virtual machines using the virtio network transport
Distributions shipping vulnerable Linux kernel builds

Discovery Timeline

2026-07-27 - CVE-2026-64552 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64552

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in the Linux kernel virtio-net receive path. receive_big() bounds the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE. This bound is loose because add_recvbuf_big() places sg[1] at offset sizeof(struct padded_vnet_hdr) into the first page. The chain therefore carries hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE bytes. For the common hdr_len == 12 case, this is 20 bytes less than the check allows.

A malicious backend can advertise a length that fits in that gap. page_to_skb() then walks one fragment past the actual page chain. The kernel stores a NULL page->private into skb_shinfo()->frags[MAX_SKB_FRAGS], which lies past the static fragment array. Downstream receive processing subsequently handles a NULL fragment pointer, compounding the corruption.

Root Cause

The root cause is an incorrect upper bound on the device-supplied length parameter in receive_big(). The check does not account for the header padding offset applied by add_recvbuf_big(), so it validates against a size larger than the actual scatter-gather chain provides. The fix tightens the bound to match the size that add_recvbuf_big() actually advertised.

Attack Vector

Exploitation requires a malicious or compromised virtio backend, such as a hostile hypervisor, a compromised host userspace virtio device, or a rogue vhost implementation. The attacker crafts a receive descriptor with a len value that falls into the 20-byte gap left by the loose bound check. When the guest processes the packet through page_to_skb(), the guest kernel performs an out-of-bounds write past skb_shinfo()->frags[]. This corrupts adjacent kernel memory in the guest and enqueues a NULL fragment, which is later dereferenced by the receive pipeline.

No synthetic proof-of-concept is included. See the upstream fix commits referenced under Patch Information for the exact code paths.

Detection Methods for CVE-2026-64552

Indicators of Compromise

Guest kernel oops, panic, or NULL pointer dereference messages originating in virtio_net, page_to_skb, or skb_release_data call paths
KASAN reports flagging out-of-bounds writes at skb_shinfo+frags offsets on guests with debug kernels
Unexpected guest reboots or network stack instability that correlate with traffic from a specific host or backend

Detection Strategies

Inventory Linux kernel versions across guest VMs and compare against the fixed commits listed under Patch Information.
Monitor guest dmesg and kernel crash telemetry for virtio_net receive-path faults.
In multi-tenant or nested virtualization environments, audit the trust boundary between guest and backend and flag guests connected to untrusted virtio hosts.

Monitoring Recommendations

Forward guest kernel logs and crash dumps to a central logging or SIEM platform for correlation across the fleet.
Alert on repeated virtio_net receive errors or skb fragment anomalies from the same host.
Track kernel package versions as part of vulnerability management to confirm patch deployment progress.

How to Mitigate CVE-2026-64552

Immediate Actions Required

Apply the upstream Linux kernel patches or vendor-backported updates that tighten the receive_big() length check.
Prioritize guests that connect to virtio backends outside the tenant's trust boundary, including nested virtualization scenarios.
Restart affected guest VMs after kernel updates so the fixed virtio_net driver is loaded.

Patch Information

The issue is resolved in upstream Linux kernel commits. Refer to the following stable-tree fixes: Kernel Git Commit 38e94d63, Kernel Git Commit 9e5ad06e, Kernel Git Commit c7fc9adf, Kernel Git Commit e6b8463b, Kernel Git Commit f9451d0f, and Kernel Git Commit fbeb6515. Deploy the kernel package supplied by your Linux distribution once it incorporates these fixes.

Workarounds

Where feasible, run guests only against trusted virtio backends managed by the same security domain as the guest.
Where kernel updates cannot be immediately deployed, consider switching guests to alternative network transports that do not use the virtio_net big-packet receive path.
Restrict host-side access to the vhost and QEMU processes that back guest virtio devices to reduce the risk of a compromised backend.

bash

# Verify running kernel version and confirm the fix is applied
uname -r
# On Debian/Ubuntu
apt list --installed 2>/dev/null | grep linux-image
# On RHEL/CentOS/Fedora
rpm -q kernel