CVE-2026-64552: 
Linux Debian vulnerability analysis and mitigation

CVE-2026-64552 is an out-of-bounds write vulnerability in the Linux kernel's virtio-net driver, specifically in the receive_big() function's packet length validation logic. The flaw allows a malicious virtio backend to trigger a NULL pointer write past the static fragment array in kernel memory, potentially leading to memory corruption and local code execution. It was published on July 27, 2026, and affects Linux kernel versions 6.1.159–6.1.177, 6.6.117–6.6.144, 6.12.58–6.12.96, and 6.17.8–6.17.x, among other git-tracked ranges. The CVSS estimate is Medium severity; the EPSS score is 0.0 (GitHub Advisory, Feedly).

The root cause is an off-by-one bounds check error (CWE-787: Out-of-Bounds Write) in receive_big() within the Linux kernel's virtio-net driver. The function bounds the device-announced packet length by (big_packets_num_skbfrags + 1) * PAGE_SIZE, but add_recvbuf_big() places sg[1] at an offset of sizeof(struct padded_vnet_hdr) into the first page, meaning the actual buffer capacity is hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE — approximately 20 bytes less than the check permits when hdr_len == 12. A malicious virtio backend can announce a length value within this 20-byte gap, causing page_to_skb() to walk one fragment past the end of the page chain and store a NULL page->private value into skb_shinfo()->frags[MAX_SKB_FRAGS], which is both an out-of-bounds write past the static frag array and a NULL frag propagated up the receive path (GitHub Advisory, Feedly).

Successful exploitation can result in kernel memory corruption due to the out-of-bounds NULL write into skb_shinfo()->frags[MAX_SKB_FRAGS], which may lead to local code execution with kernel privileges. The NULL frag propagated up the receive path can also cause unpredictable kernel behavior, including system crashes (denial of service). Exploitation is constrained to attackers with local control over a virtio backend, limiting the attack surface primarily to virtualized environments where a guest or co-tenant can manipulate the backend (Feedly, GitHub Advisory).

1. Precondition: Attacker must control a virtio backend (e.g., a malicious hypervisor, QEMU backend, or co-tenant in a virtualized environment) communicating with a vulnerable Linux guest kernel running the virtio-net driver.
2. Identify target: Confirm the guest kernel version falls within an affected range (e.g., 6.1.159–6.1.177, 6.6.117–6.6.144, 6.12.58–6.12.96) and that big-packet mode (big_packets_num_skbfrags) is active.
3. Craft malicious packet length: Announce a packet length that falls within the ~20-byte gap between the actual buffer capacity (hdr_len + (PAGE_SIZE - sizeof(padded_vnet_hdr)) + big_packets_num_skbfrags * PAGE_SIZE) and the overly permissive bound ((big_packets_num_skbfrags + 1) * PAGE_SIZE) used by receive_big().
4. Trigger out-of-bounds write: The guest kernel's receive_big() accepts the announced length; page_to_skb() walks one fragment past the allocated page chain, writing a NULL page->private value into skb_shinfo()->frags[MAX_SKB_FRAGS] — an out-of-bounds location in kernel memory.
5. Achieve impact: The NULL frag is propagated up the receive path, potentially causing kernel memory corruption, a kernel panic (DoS), or, with additional exploitation primitives, local privilege escalation (Feedly, GitHub Advisory).

• Logs: Kernel oops or BUG messages referencing virtio_net, receive_big, page_to_skb, or skb_shinfo in /var/log/kern.log or dmesg output.
• Logs: Kernel warnings about NULL pointer dereferences or out-of-bounds access in the network receive path.
• Process/Kernel: Unexpected kernel panics or system crashes in virtualized Linux guests running virtio-net, particularly during high-throughput network activity.
• Network: Anomalous packet length values announced by the virtio backend that exceed the expected buffer size for the configured big_packets_num_skbfrags setting.

Update the Linux kernel to a patched version: 6.1.178 or later (for the 6.1.x branch), 6.6.145 or later (6.6.x), 6.12.97 or later (6.12.x), 6.18.40 or later (6.18.x), 7.1.5 or later (7.1.x), or 7.2-rc1 and later. As a workaround where patching is not immediately possible, restrict access to virtio backends to trusted sources only, since exploitation requires control of the device backend. In cloud or multi-tenant environments, ensure hypervisor-level isolation prevents untrusted guests from manipulating virtio backend behavior (GitHub Advisory, Feedly).