01 Record

CVE-2026-64552

virtio-net: fix len check in receive_big()

HighPUBLISHEDCNA: Linux

CNA base score8.4 CVSS v3.xCVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

View raw JSON

02 Description

virtio-net: fix len check in receive_big()

03 Exploitation and scoring

Exploitation

Assessed, none found. CISA's assessment recorded neither public exploit code nor evidence of exploitation when it was made.

SSVC decision

ExploitationnoneCISA recorded no public exploit code and no evidence of exploitation.
AutomatablenoAt least one step from reconnaissance to exploitation cannot be reliably automated.
Technical ImpacttotalSuccessful exploitation gives total control of the vulnerable component.

CISA publishes the decision points, not a final SSVC decision. The decision also depends on mission and well-being impact, which is a property of your deployment rather than of the vulnerability.

EPSS probability

0.14% probability of exploitation activity in the next 30 days.

EPSS percentile

Equal to or higher than the score of 3.5% of scored records. A rank, not a probability.

NVD base score

8.4 (CVSS v3.x), scored by the NVD independently of the CNA.

NVD CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

NVD analysis status

Received. NVD last modified this record on 2026-10-19.

Red Hat severity

Important. Red Hat's rating for its own products, not a CVSS rating.

Exploit-prediction scores from FIRST. Independent scoring and analysis status from the NVD. Vendor severity from Red Hat. Exploitation assessment and catalog membership from CISA.

04 Metadata

Published

2026-07-27 20:10Z3 MO AGO

Last updated

2026-10-19 20:48Z9 DAYS AGO

Reserved

2026-07-19

Assigning CNA

Linux

Record state

PUBLISHED

Severity

High (CVSS 8.4)

CNA CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weaknesses

CWE-787Out-of-bounds WriteBase

Data version

5.2

Document digest

08ddee0b1ca89dcb127974c518d200e1e0510cbc60d9471e0516d305de7f47c2

05 Affected products

VendorProductVersionsPlatforms

LinuxLinux82f9028e83944a9eee5229cbc6fee9be1de8a62d to < f9451d0fd5ba635dcabb49bfe456a6db734a8986, 946dec89c41726b94d31147ec528b96af0be1b5a to < 38e94d63e29f4a5c6eae87ee2c02101aaa321502, 82fe78065450d2d07f36a22e2b6b44955cf5ca5b to < fbeb65154583879d556ea94cb2f15888e9470f3d, 0c716703965ffc5ef4311b65cb5d84a703784717 to < c7fc9adf4e006155f7f2aeda052fbcde25cdcc49, 0c716703965ffc5ef4311b65cb5d84a703784717 to < e6b8463b7d791f3886d7584259d6e9f06a69f12e, 0c716703965ffc5ef4311b65cb5d84a703784717 to < 9e5ad06ea826322ce8c58b4a68442a96f600c3c4, 3e9d89f2ecd3636bd4cbdfd0b2dfdaf58f9882e2, 6.1.159 to < 6.1.178, 6.6.117 to < 6.6.145, 6.12.58 to < 6.12.97, 6.17.8 to < 6.18, 6.18—

06 References

git.kernel.orghttps://git.kernel.org/stable/c/f9451d0fd5ba635dcabb49bfe456a6db734a8986
git.kernel.orghttps://git.kernel.org/stable/c/38e94d63e29f4a5c6eae87ee2c02101aaa321502
git.kernel.orghttps://git.kernel.org/stable/c/fbeb65154583879d556ea94cb2f15888e9470f3d
git.kernel.orghttps://git.kernel.org/stable/c/c7fc9adf4e006155f7f2aeda052fbcde25cdcc49
git.kernel.orghttps://git.kernel.org/stable/c/e6b8463b7d791f3886d7584259d6e9f06a69f12e
git.kernel.orghttps://git.kernel.org/stable/c/9e5ad06ea826322ce8c58b4a68442a96f600c3c4
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-019113.html
cert-portal.siemens.comhttps://cert-portal.siemens.com/productcert/html/ssa-457936.html

07 Fixed in

Debian 12

linux
Fixed in 6.1.180-1
linux-6.12
Fixed in 6.12.100-1~deb12u1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 13

linux
Fixed in 6.12.100-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.

Debian 14

linux
Fixed in 7.1.5-1

Source: Debian Security Tracker, the Debian security team. Received through OSV.dev. Reformatted by exploit.cc.