CVE-2026-64527: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-64527 is a memory disclosure vulnerability in the Linux kernel's DRM Hyper-V driver (drm/hyperv) caused by missing VMBus packet size validation in the hyperv_receive_sub() receive callback. The flaw allows up to 16 KiB of residual kernel memory from prior messages to be exposed to guest userspace applications waiting on completion handlers. It affects Linux kernel versions from 5.14 up to (but not including) the patched stable releases: 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, and 7.1. The vulnerability was published on July 25, 2026, with a Feedly CVSS category estimate of Medium and an EPSS score of 0.00215 (Github Advisory, Feedly).

The root cause is insufficient input validation (related to CWE-125: Out-of-bounds Read / memory disclosure) in hyperv_receive_sub(), which reads msg->vid_hdr.type and dispatches into one of four message-type branches without first verifying how many bytes the Hyper-V host actually wrote into hv->recv_buf. The completion path then executes memcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), allowing a consumer woken by wait_for_completion_timeout() to read up to 16 KiB of stale data from a prior message as if it were a valid response payload. Affected message types include SYNTHVID_VERSION_RESPONSE, SYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK, and SYNTHVID_FEATURE_CHANGE; the variable-length SYNTHVID_RESOLUTION_RESPONSE also lacks proper bounds checking on the resolution_count field. Additionally, when vmbus_recvpacket() returns -ENOBUFS, the reported required length can exceed the 16 KiB buffer, meaning copying bytes_recvd would read and write past buffer boundaries (Github Advisory).

A privileged Hyper-V host can send specially crafted VMBus packets to a guest kernel running a vulnerable Linux version, causing the guest to leak up to 16 KiB of sensitive kernel memory — including residual data from prior messages — to guest userspace applications waiting on completion handlers. This is a confidentiality impact affecting virtualized Linux guests; integrity and availability are not directly impacted. The attack is constrained to the host-to-guest trust boundary, making it most relevant in environments where the Hyper-V host is not fully trusted (e.g., cloud multi-tenant scenarios or compromised hypervisors) (Feedly, Github Advisory).

Update the Linux kernel to a patched stable release: 5.15.210, 6.1.176, 6.6.143, 6.12.93, 6.18.35, 7.0.12, or 7.1 and later. The fix passes bytes_recvd into hyperv_receive_sub(), rejects packets that do not cover the pipe and synthvid header, enforces type-specific payload size checks before any memcpy/complete call, and gates the copy on a successful vmbus_recvpacket() return. Until patching is possible, restrict guest kernel memory isolation and monitor for unusual DRM Hyper-V driver activity, particularly in environments where the Hyper-V host is not fully trusted (Github Advisory, Feedly).