CVE-2026-64550

In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: validate MAP frame length before ingress parsing

When ingress deaggregation is disabled, rmnetmapingress_handler() passes the skb straight to __rmnetmapingresshandler(), skipping the length validation that rmnetmapdeaggregate() performs on the aggregated path. The parser then dereferences the MAP header and csum header/trailer based on the on-wire pktlen without checking skb->len, so a short frame is read out of bounds:

BUG: KASAN: slab-out-of-bounds in rmnetmapchecksumdownlinkpacket Read of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: ... rmnetmapchecksumdownlinkpacket (drivers/net/ethernet/qualcomm/rmnet/rmnetmapdata.c:413) __rmnetmapingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnethandlers.c:96) rmnetrxhandler (drivers/net/ethernet/qualcomm/rmnet/rmnethandlers.c:129) _netifreceiveskbcore.constprop.0 (net/core/dev.c:6089) netifreceiveskb (net/core/dev.c:6460) tungetuser (drivers/net/tun.c:1955) tunchrwriteiter (drivers/net/tun.c:2001) vfswrite (fs/readwrite.c:688) ksyswrite (fs/readwrite.c:740) dosyscall64 (arch/x86/entry/syscall64.c:94) ...

Factor that validation out of rmnetmapdeaggregate() into rmnetmapvalidatepacketlen() and run it on the no-aggregation path too. The MAP header is bounds-checked first, since this path can receive a frame shorter than the header.