In the Linux kernel, the following vulnerability has been resolved:
virtio-net: fix len check in receive_big()
receivebig() bounds the device-announced length by (bigpacketsnumskbfrags + 1) * PAGESIZE. That is still too loose: addrecvbufbig() sets sg[1] to start at offset sizeof(struct paddedvnethdr) into the first page, so the chain actually carries hdrlen + (PAGESIZE - sizeof(paddedvnethdr)) + bigpacketsnumskbfrags * PAGESIZE bytes -- 20 bytes less than the check allows for the common hdrlen == 12 case.
A malicious virtio backend can announce a len in that gap. pagetoskb() then walks one frag past the page chain, storing a NULL page->private into skbshinfo()->frags[MAXSKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag handed up the rx path.
Bound len by the size addrecvbufbig() actually advertised.
{
"cna_assigner": "Linux",
"osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/64xxx/CVE-2026-64552.json"
}