Buffer Overflow in Linux Kernel Virtio Network Module

CVE-2026-64552

What is CVE-2026-64552?

A vulnerability in the Linux kernel's virtio network module allows a malicious backend to exploit a len check issue in the receive_big() function. This flaw can lead to an out-of-bounds write, potentially compromising system stability. The vulnerability arises from insufficient bounds checking of the device-announced length, specifically when handling fragmented packets. A detailed fix was implemented to ensure that the length is correctly bounded by the parameters advertised by the add_recvbuf_big() function. It’s essential for users to update their Linux kernel to mitigate this risk.

References