CVE-2026-64527 - Vulnerability Details

- drm/hyperv: validate VMBus packet size in receive callback

Description

In the Linux kernel, the following vulnerability has been resolved:

drm/hyperv: validate VMBus packet size in receive callback

hyperv_receive_sub() reads msg->vid_hdr.type and dispatches into one
of four message-type branches without knowing how many bytes the host
wrote into hv->recv_buf. The completion path then runs
memcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that
wakes on wait_for_completion_timeout() can read up to 16 KiB of
residue from a prior message as if it were the response payload.

Pass bytes_recvd into hyperv_receive_sub() and reject any packet that
does not cover the pipe + synthvid header. A single switch on
msg->vid_hdr.type then computes the type-specific payload size: the
three completion-driving types (SYNTHVID_VERSION_RESPONSE,
SYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK) fall through
to a shared exit that requires that size before memcpy/complete, while
SYNTHVID_FEATURE_CHANGE validates its own payload and returns before
reading is_dirt_needed. Unknown types are dropped.

SYNTHVID_RESOLUTION_RESPONSE is variable length: the host fills
resolution_count entries, not the full SYNTHVID_MAX_RESOLUTION_COUNT
array. Validate the fixed prefix first so resolution_count can be
read, bound it against the array, then require only the count-sized
array, so the shorter responses the host actually sends are accepted.

Only run the sub-handler when vmbus_recvpacket() returned success. The
memcpy length is bytes_recvd, which is bounded by VMBUS_MAX_PACKET_SIZE
only on a successful receive; on -ENOBUFS vmbus_recvpacket() instead
reports the required length, which can exceed hv->recv_buf, so copying
bytes_recvd would read and write past the 16 KiB buffers. Gating on the
success return keeps the copy bounded. The nonzero-return path is itself
a malformed-message case and is now logged rather than silently skipped;
channel recovery is not attempted.

Rejected packets are reported via drm_err_ratelimited() rather than
silently dropped, matching the CoCo-hardened pattern in
hv_kvp_onchannelcallback().

Published: 2026-07-25

Score: 7.0 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

In the Linux kernel, the hyperv DRM driver fails to validate the size of incoming VMBus packets before copying data into a 16 KiB buffer. The receive callback reads the packet type without knowing how many bytes the host supplied, then performs a memcpy based on a maximum constant size. This oversight allows a packet larger than expected to read or overwrite memory beyond the buffer, creating an out‑of‑bounds read or write (CWE‑805). The resulting memory corruption could cause a kernel panic or provide a foothold for privilege escalation within the guest.

Affected Systems

All Linux kernel versions that include the hyperv DRM driver and have not applied the commit that introduces packet‑size validation (commit 049a6b474823049fe60212f25f26e4b30f44ee8f) are affected. No distribution‑specific version information is listed, so any unpatched kernel should be treated as vulnerable.

Risk and Exploitability

The CVSS score is 7.0 and the EPSS score is reported as less than 1 %, indicating a low mass‑exploitation likelihood. The vulnerability is not listed in the CISA KEV catalog. Exploitation would require control over the Hyper‑V hypervisor or the ability to send crafted VMBus packets into the guest. If successfully triggered, the out‑of‑bounds access could lead to a kernel crash or privilege escalation depending on additional kernel protection mechanisms.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`76c56a5affeba1e163b66b9d8cc192e6154466f0`	affected	< 57d5d697642e05d5dd2d40660817765943dd709f
`76c56a5affeba1e163b66b9d8cc192e6154466f0`	affected	< f5251226551bfec98c4705641b6f94ff1f238d91
`76c56a5affeba1e163b66b9d8cc192e6154466f0`	affected	< 049a6b474823049fe60212f25f26e4b30f44ee8f
`76c56a5affeba1e163b66b9d8cc192e6154466f0`	affected	< 588c84b461393ff1998ac7b97b04f953f642e0df
`76c56a5affeba1e163b66b9d8cc192e6154466f0`	affected	< 164dc7bf17609340233c6bf4f66bb7c7008a0511
`76c56a5affeba1e163b66b9d8cc192e6154466f0`	affected	< c8974d96b6a5496f33dc69a3ce28a7bf5078def4
`76c56a5affeba1e163b66b9d8cc192e6154466f0`	affected	< 7f87763f47a3c22fb50265a00619ef10f2394b18

Linux

affected

Version	Status	Constraints
`5.14`	affected	—
`0`	unaffected	< 5.14
`5.15.210`	unaffected	≤ 5.15.*
`6.1.176`	unaffected	≤ 6.1.*
`6.6.143`	unaffected	≤ 6.6.*
`6.12.93`	unaffected	≤ 6.12.*
`6.18.35`	unaffected	≤ 6.18.*
`7.0.12`	unaffected	≤ 7.0.*
`7.1`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[76c56a5affeba1e163b66b9d8cc192e6154466f0,57d5d697642e05d5dd2d40660817765943dd709f)`	affected	code_commit	—
`[76c56a5affeba1e163b66b9d8cc192e6154466f0,f5251226551bfec98c4705641b6f94ff1f238d91)`	affected	code_commit	—
`[76c56a5affeba1e163b66b9d8cc192e6154466f0,049a6b474823049fe60212f25f26e4b30f44ee8f)`	affected	code_commit	—
`[76c56a5affeba1e163b66b9d8cc192e6154466f0,588c84b461393ff1998ac7b97b04f953f642e0df)`	affected	code_commit	—
`[76c56a5affeba1e163b66b9d8cc192e6154466f0,164dc7bf17609340233c6bf4f66bb7c7008a0511)`	affected	code_commit	—
`[76c56a5affeba1e163b66b9d8cc192e6154466f0,c8974d96b6a5496f33dc69a3ce28a7bf5078def4)`	affected	code_commit	—
`[76c56a5affeba1e163b66b9d8cc192e6154466f0,7f87763f47a3c22fb50265a00619ef10f2394b18)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`5.14`	affected	semver	—
`[0,5.14)`	unaffected	semver	—
`[5.15.210,5.16.0)`	unaffected	semver	—
`[6.1.176,6.2.0)`	unaffected	semver	—
`[6.6.143,6.7.0)`	unaffected	semver	—
`[6.12.93,6.13.0)`	unaffected	semver	—
`[6.18.35,6.19.0)`	unaffected	semver	—
`[7.0.12,7.1.0)`	unaffected	semver	—
`[7.1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Apply the latest Linux kernel that incorporates the packet‑size validation fix for the hyperv DRM driver (commit 049a6b474823049fe60212f25f26e4b30f44ee8f).
If upgrading the kernel is not feasible, disable the hyperv DRM driver or the VMBus interface when the service is not required.
Configure the system to log drm_err_ratelimited events and alert on repeated occurrences, enabling early detection of attempted exploitation.

Generated by OpenCVE AI on August 2, 2026 at 12:10 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Ubuntu USN	USN-8618-1	Linux kernel vulnerabilities

No CVSS v4.0

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00161.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/049a6b474823049fe60212f25f26e4b30f44ee8f
https://git.kernel.org/stable/c/164dc7bf17609340233c6bf4f66bb7c7008a0511
https://git.kernel.org/stable/c/57d5d697642e05d5dd2d40660817765943dd709f
https://git.kernel.org/stable/c/588c84b461393ff1998ac7b97b04f953f642e0df
https://git.kernel.org/stable/c/7f87763f47a3c22fb50265a00619ef10f2394b18
https://git.kernel.org/stable/c/c8974d96b6a5496f33dc69a3ce28a7bf5078def4
https://git.kernel.org/stable/c/f5251226551bfec98c4705641b6f94ff1f238d91
https://lore.kernel.org/linux-cve-announce/2026072534-CVE-2026-64527-0c42@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64527
https://www.cve.org/CVERecord?id=CVE-2026-64527

History

Thu, 30 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-805
References		https://lore.kernel.org/linux-cve-announce/2026072534-CVE-2026-64527-0c42@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64527 https://www.cve.org/CVERecord?id=CVE-2026-64527
Metrics	threat_severity `None`	cvssV3_1 `{'score': 7.0, 'vector': 'CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H'}` threat_severity `Moderate`

Sat, 25 Jul 2026 10:00:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hyperv_receive_sub() reads msg->vid_hdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv->recv_buf. The completion path then runs memcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that wakes on wait_for_completion_timeout() can read up to 16 KiB of residue from a prior message as if it were the response payload. Pass bytes_recvd into hyperv_receive_sub() and reject any packet that does not cover the pipe + synthvid header. A single switch on msg->vid_hdr.type then computes the type-specific payload size: the three completion-driving types (SYNTHVID_VERSION_RESPONSE, SYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK) fall through to a shared exit that requires that size before memcpy/complete, while SYNTHVID_FEATURE_CHANGE validates its own payload and returns before reading is_dirt_needed. Unknown types are dropped. SYNTHVID_RESOLUTION_RESPONSE is variable length: the host fills resolution_count entries, not the full SYNTHVID_MAX_RESOLUTION_COUNT array. Validate the fixed prefix first so resolution_count can be read, bound it against the array, then require only the count-sized array, so the shorter responses the host actually sends are accepted. Only run the sub-handler when vmbus_recvpacket() returned success. The memcpy length is bytes_recvd, which is bounded by VMBUS_MAX_PACKET_SIZE only on a successful receive; on -ENOBUFS vmbus_recvpacket() instead reports the required length, which can exceed hv->recv_buf, so copying bytes_recvd would read and write past the 16 KiB buffers. Gating on the success return keeps the copy bounded. The nonzero-return path is itself a malformed-message case and is now logged rather than silently skipped; channel recovery is not attempted. Rejected packets are reported via drm_err_ratelimited() rather than silently dropped, matching the CoCo-hardened pattern in hv_kvp_onchannelcallback().
Title		drm/hyperv: validate VMBus packet size in receive callback
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/049a6b474823049fe60212f25f26e4b30f44ee8f https://git.kernel.org/stable/c/164dc7bf17609340233c6bf4f66bb7c7008a0511 https://git.kernel.org/stable/c/57d5d697642e05d5dd2d40660817765943dd709f https://git.kernel.org/stable/c/588c84b461393ff1998ac7b97b04f953f642e0df https://git.kernel.org/stable/c/7f87763f47a3c22fb50265a00619ef10f2394b18 https://git.kernel.org/stable/c/c8974d96b6a5496f33dc69a3ce28a7bf5078def4 https://git.kernel.org/stable/c/f5251226551bfec98c4705641b6f94ff1f238d91

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-25T09:20:51.078Z

Updated: 2026-07-25T09:20:51.078Z

Reserved: 2026-07-19T15:36:31.794Z

Link: CVE-2026-64527

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-25T10:17:39.053

Modified: 2026-07-25T10:17:39.053

Link: CVE-2026-64527

Redhat

Severity : Moderate

Publid Date: 2026-07-25T00:00:00Z

Links: CVE-2026-64527 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-02T12:15:18Z

Weaknesses

CWE-805
Buffer Access with Incorrect Length Value

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity High

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object