GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

CVE-2026-64550 (GCVE-0-2026-64550)

Vulnerability from cvelistv5 – Published: 2026-07-27 20:10 – Updated: 2026-08-17 04:57
VLAI
Title
net: qualcomm: rmnet: validate MAP frame length before ingress parsing
Summary
In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handler(), skipping the length validation that rmnet_map_deaggregate() performs on the aggregated path. The parser then dereferences the MAP header and csum header/trailer based on the on-wire pkt_len without checking skb->len, so a short frame is read out of bounds: BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet Read of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: ... rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413) __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089) netif_receive_skb (net/core/dev.c:6460) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2001) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Factor that validation out of rmnet_map_deaggregate() into rmnet_map_validate_packet_len() and run it on the no-aggregation path too. The MAP header is bounds-checked first, since this path can receive a frame shorter than the header.
Severity
7.3 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < ed25befc8c36f896b5878f9078faddb67fd7e2d0 (git)
Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < a54d76d176e50d2fdbd39b7231efe256170339e4 (git)
Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 00f4c366dbca16a40772c3b7ec2d8cba839e9724 (git)
Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 3868c3244369ab709a90c9aad7534d406009b824 (git)
Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 14eb0c9491385d5361a292ea4974aec0e6887299 (git)
Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 1b12612c367e4be9b0814c0468e7e687835315b4 (git)
Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < 231a8a4b76cb1b1827b3b19d7b3603642f5aaaef (git)
Affected: ceed73a2cf4aff2921802aa3d21d45280677547d , < f0f1887a9e30712a1df03e152dce6fb91344b1f3 (git)
guessed Create a notification for this product.
Linux Linux Affected: 4.14
Unaffected: 0 , < 4.14 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.97 , ≤ 6.12.* (semver)
Unaffected: 6.18.40 , ≤ 6.18.* (semver)
Unaffected: 7.1.5 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c",
            "drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h",
            "drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "ed25befc8c36f896b5878f9078faddb67fd7e2d0",
              "status": "affected",
              "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
              "versionType": "git"
            },
            {
              "lessThan": "a54d76d176e50d2fdbd39b7231efe256170339e4",
              "status": "affected",
              "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
              "versionType": "git"
            },
            {
              "lessThan": "00f4c366dbca16a40772c3b7ec2d8cba839e9724",
              "status": "affected",
              "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
              "versionType": "git"
            },
            {
              "lessThan": "3868c3244369ab709a90c9aad7534d406009b824",
              "status": "affected",
              "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
              "versionType": "git"
            },
            {
              "lessThan": "14eb0c9491385d5361a292ea4974aec0e6887299",
              "status": "affected",
              "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
              "versionType": "git"
            },
            {
              "lessThan": "1b12612c367e4be9b0814c0468e7e687835315b4",
              "status": "affected",
              "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
              "versionType": "git"
            },
            {
              "lessThan": "231a8a4b76cb1b1827b3b19d7b3603642f5aaaef",
              "status": "affected",
              "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
              "versionType": "git"
            },
            {
              "lessThan": "f0f1887a9e30712a1df03e152dce6fb91344b1f3",
              "status": "affected",
              "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c",
            "drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h",
            "drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.14"
            },
            {
              "lessThan": "4.14",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.97",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.40",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.5",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.97",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.40",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.5",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "4.14",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qualcomm: rmnet: validate MAP frame length before ingress parsing\n\nWhen ingress deaggregation is disabled, rmnet_map_ingress_handler() passes\nthe skb straight to __rmnet_map_ingress_handler(), skipping the length\nvalidation that rmnet_map_deaggregate() performs on the aggregated path.\nThe parser then dereferences the MAP header and csum header/trailer based on\nthe on-wire pkt_len without checking skb-\u003elen, so a short frame is read out\nof bounds:\n\n  BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet\n  Read of size 1 at addr ffff88801118ed00 by task exploit/147\n  Call Trace:\n   ...\n   rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)\n   __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)\n   rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)\n   __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)\n   netif_receive_skb (net/core/dev.c:6460)\n   tun_get_user (drivers/net/tun.c:1955)\n   tun_chr_write_iter (drivers/net/tun.c:2001)\n   vfs_write (fs/read_write.c:688)\n   ksys_write (fs/read_write.c:740)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   ...\n\nFactor that validation out of rmnet_map_deaggregate() into\nrmnet_map_validate_packet_len() and run it on the no-aggregation path too.\nThe MAP header is bounds-checked first, since this path can receive a frame\nshorter than the header."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerability is reached by `write()` to a tun fd owned by the attacker, exactly as in the reporter\u0027s KASAN trace (`tun_chr_write_iter` \u2192 `netif_receive_skb` \u2192 `rmnet_rx_handler`), requiring a local account. Although rmnet can be stacked on an Ethernet device (commit 74692caf1b0b), the universally available and demonstrated vector is local.\nAC:L - Every precondition is attacker-chosen \u2014 the `data_format` flags (deaggregation off, CKSUMV4 on) via `IFLA_RMNET_FLAGS`, the frame length, and the `pkt_len`/`pad` fields that select the OOB offset \u2014 with no race, timing, or uncontrolled memory-layout dependency. The trigger is a single deterministic `write()` that can be repeated indefinitely to sweep offsets.\nPR:L - Only an unprivileged local account is needed: `/dev/net/tun` is world-accessible, and both `TUNSETIFF` and `rtnl_newlink` gate on namespace-scoped `ns_capable`/`netlink_net_capable(CAP_NET_ADMIN)`, which `unshare -Urn` grants without real root.\nUI:N - The attacker creates the tun device, the rmnet link, and writes the malformed frame entirely on its own. No victim action or pre-existing configuration is required.\nS:U - The out-of-bounds access and its consequences are confined to kernel memory within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.\nC:H - This is an attacker-positioned read up to 65535 bytes past a small slab object, and the result is disclosed back to userspace through the unprivileged rmnet ethtool counters \u2014 because the pseudo-header checksum is computed from the attacker\u0027s own IP header, the exact 16-bit heap word at a chosen offset is recoverable in a few probes, yielding a precise heap-read primitive for KASLR bypass and secret disclosure.\nI:L - There is no arbitrary write, but out-of-bounds data determines `skb-\u003eip_summed = CHECKSUM_UNNECESSARY`, causing packets whose checksums were never validated to be accepted by the IP stack as verified. On the MAP-command path `rmnet_map_send_ack()` also writes `cmd-\u003ecmd_type` past the end of a short frame after `skb_trim()` underflows into a no-op.\nA:H - A 64 KB overshoot from a small kmalloc object can land on an unmapped page (guard pages, DEBUG_PAGEALLOC/hardened allocators, memory-region edges), faulting in kernel context and producing an oops; on the real WWAN receive path (ipa/qmi_wwan/mhi_net NAPI) this executes in softirq, where the fault is a panic. KASAN builds abort immediately, as the reporter\u0027s trace shows."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:57:27.672Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/ed25befc8c36f896b5878f9078faddb67fd7e2d0"
        },
        {
          "url": "https://git.kernel.org/stable/c/a54d76d176e50d2fdbd39b7231efe256170339e4"
        },
        {
          "url": "https://git.kernel.org/stable/c/00f4c366dbca16a40772c3b7ec2d8cba839e9724"
        },
        {
          "url": "https://git.kernel.org/stable/c/3868c3244369ab709a90c9aad7534d406009b824"
        },
        {
          "url": "https://git.kernel.org/stable/c/14eb0c9491385d5361a292ea4974aec0e6887299"
        },
        {
          "url": "https://git.kernel.org/stable/c/1b12612c367e4be9b0814c0468e7e687835315b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/231a8a4b76cb1b1827b3b19d7b3603642f5aaaef"
        },
        {
          "url": "https://git.kernel.org/stable/c/f0f1887a9e30712a1df03e152dce6fb91344b1f3"
        }
      ],
      "title": "net: qualcomm: rmnet: validate MAP frame length before ingress parsing",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64550",
    "datePublished": "2026-07-27T20:10:39.459Z",
    "dateReserved": "2026-07-19T15:36:31.796Z",
    "dateUpdated": "2026-08-17T04:57:27.672Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64550",
      "date": "2026-09-20",
      "epss": "0.00126",
      "percentile": "0.02619"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c",
                  "drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h",
                  "drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "ed25befc8c36f896b5878f9078faddb67fd7e2d0",
                    "status": "affected",
                    "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "a54d76d176e50d2fdbd39b7231efe256170339e4",
                    "status": "affected",
                    "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "00f4c366dbca16a40772c3b7ec2d8cba839e9724",
                    "status": "affected",
                    "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "3868c3244369ab709a90c9aad7534d406009b824",
                    "status": "affected",
                    "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "14eb0c9491385d5361a292ea4974aec0e6887299",
                    "status": "affected",
                    "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "1b12612c367e4be9b0814c0468e7e687835315b4",
                    "status": "affected",
                    "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "231a8a4b76cb1b1827b3b19d7b3603642f5aaaef",
                    "status": "affected",
                    "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "f0f1887a9e30712a1df03e152dce6fb91344b1f3",
                    "status": "affected",
                    "version": "ceed73a2cf4aff2921802aa3d21d45280677547d",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c",
                  "drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h",
                  "drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "4.14"
                  },
                  {
                    "lessThan": "4.14",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.97",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.40",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.5",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: qualcomm: rmnet: validate MAP frame length before ingress parsing\n\nWhen ingress deaggregation is disabled, rmnet_map_ingress_handler() passes\nthe skb straight to __rmnet_map_ingress_handler(), skipping the length\nvalidation that rmnet_map_deaggregate() performs on the aggregated path.\nThe parser then dereferences the MAP header and csum header/trailer based on\nthe on-wire pkt_len without checking skb-\u003elen, so a short frame is read out\nof bounds:\n\n  BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet\n  Read of size 1 at addr ffff88801118ed00 by task exploit/147\n  Call Trace:\n   ...\n   rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)\n   __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)\n   rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)\n   __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)\n   netif_receive_skb (net/core/dev.c:6460)\n   tun_get_user (drivers/net/tun.c:1955)\n   tun_chr_write_iter (drivers/net/tun.c:2001)\n   vfs_write (fs/read_write.c:688)\n   ksys_write (fs/read_write.c:740)\n   do_syscall_64 (arch/x86/entry/syscall_64.c:94)\n   ...\n\nFactor that validation out of rmnet_map_deaggregate() into\nrmnet_map_validate_packet_len() and run it on the no-aggregation path too.\nThe MAP header is bounds-checked first, since this path can receive a frame\nshorter than the header."
          }
        ],
        "id": "CVE-2026-64550",
        "lastModified": "2026-08-17T05:18:00.393",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.3,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "LOW",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.5,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-27T21:17:07.867",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/00f4c366dbca16a40772c3b7ec2d8cba839e9724"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/14eb0c9491385d5361a292ea4974aec0e6887299"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/1b12612c367e4be9b0814c0468e7e687835315b4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/231a8a4b76cb1b1827b3b19d7b3603642f5aaaef"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/3868c3244369ab709a90c9aad7534d406009b824"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/a54d76d176e50d2fdbd39b7231efe256170339e4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/ed25befc8c36f896b5878f9078faddb67fd7e2d0"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "url": "https://git.kernel.org/stable/c/f0f1887a9e30712a1df03e152dce6fb91344b1f3"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Received"
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-29T06:27:33+00:00",
      "cve": "CVE-2026-64550",
      "id": "CVE-2026-64550",
      "initial_release_date": "2026-07-27T00:00:00+00:00",
      "product_status:known_not_affected": "275",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: qualcomm: rmnet: validate MAP frame length before ingress parsing",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64550.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:46:03Z",
      "cve": "CVE-2026-64550",
      "id": "CVE-2026-64550",
      "initial_release_date": "2026-07-28T17:07:55Z",
      "product_status:known_affected": "279",
      "product_status:known_not_affected": "97",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64550",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64550.json",
      "version": "7"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.