CVE-2026-64550
Description
In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handler(), skipping the length validation that rmnet_map_deaggregate() performs on the aggregated path. The parser then dereferences the MAP header and csum header/trailer based on the on-wire pkt_len without checking skb->len, so a short frame is read out of bounds: BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet Read of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: ... rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413) __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089) netif_receive_skb (net/core/dev.c:6460) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2001) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Factor that validation out of rmnet_map_deaggregate() into rmnet_map_validate_packet_len() and run it on the no-aggregation path too. The MAP header is bounds-checked first, since this path can receive a frame shorter than the header.
How to fix
- Linux Linuxed25befc8c36f896b5878f9078faddb67fd7e2d0, a54d76d176e50d2fdbd39b7231efe256170339e4, 00f4c366dbca16a40772c3b7ec2d8cba839e9724, 3868c3244369ab709a90c9aad7534d406009b824, 14eb0c9491385d5361a292ea4974aec0e6887299, 1b12612c367e4be9b0814c0468e7e687835315b4, 231a8a4b76cb1b1827b3b19d7b3603642f5aaaef, f0f1887a9e30712a1df03e152dce6fb91344b1f3 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Linux Linux | ceed73a2cf4aff2921802aa3d21d45280677547d ≤ v < ed25befc8c36f896b5878f9078faddb67fd7e2d0, ceed73a2cf4aff2921802aa3d21d45280677547d ≤ v < a54d76d176e50d2fdbd39b7231efe256170339e4, ceed73a2cf4aff2921802aa3d21d45280677547d ≤ v < 00f4c366dbca16a40772c3b7ec2d8cba839e9724, ceed73a2cf4aff2921802aa3d21d45280677547d ≤ v < 3868c3244369ab709a90c9aad7534d406009b824, ceed73a2cf4aff2921802aa3d21d45280677547d ≤ v < 14eb0c9491385d5361a292ea4974aec0e6887299, ceed73a2cf4aff2921802aa3d21d45280677547d ≤ v < 1b12612c367e4be9b0814c0468e7e687835315b4, ceed73a2cf4aff2921802aa3d21d45280677547d ≤ v < 231a8a4b76cb1b1827b3b19d7b3603642f5aaaef, ceed73a2cf4aff2921802aa3d21d45280677547d ≤ v < f0f1887a9e30712a1df03e152dce6fb91344b1f3, 4.14 | ed25befc8c36f896b5878f9078faddb67fd7e2d0, a54d76d176e50d2fdbd39b7231efe256170339e4, 00f4c366dbca16a40772c3b7ec2d8cba839e9724, 3868c3244369ab709a90c9aad7534d406009b824, 14eb0c9491385d5361a292ea4974aec0e6887299, 1b12612c367e4be9b0814c0468e7e687835315b4, 231a8a4b76cb1b1827b3b19d7b3603642f5aaaef, f0f1887a9e30712a1df03e152dce6fb91344b1f3 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.