CVE-2026-64547 - Vulnerability Details

- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

Description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

For an even packet_len, net1080_rx_fixup() reads the pad byte at
skb->data[packet_len] before the skb->len != packet_len check further
down, and packet_len is only bounded against NC_MAX_PACKET. A malicious
NetChip 1080 device can send a short frame advertising a large even
packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the
skb:

BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup
Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14
...
net1080_rx_fixup (drivers/net/usb/net1080.c:384)
usbnet_bh (drivers/net/usb/usbnet.c:1589)
process_one_work (kernel/workqueue.c:3322)
bh_worker (kernel/workqueue.c:3708)
tasklet_action (kernel/softirq.c:965)
handle_softirqs (kernel/softirq.c:622)
...

Reject the frame when packet_len >= skb->len before reading.

Published: 2026-07-27

Score: 8.1 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel’s net1080 USB driver allows an attacker controlling a NetChip 1080 device to send a specially crafted packet with an oversized even length, causing the driver to read beyond the end of the socket buffer before validating the packet size. This leads to an out-of-bounds read of the packet’s pad byte, potentially corrupting kernel memory and resulting in a system crash or denial of service. The vulnerability is classified as a memory corruption weakness (CWE‑125).

Affected Systems

All Linux systems that load the net1080 USB driver are potentially affected. This includes most Linux distributions that ship the kernel driver for NetChip 1080 hardware. The defect has been addressed in kernel patches that update the rx_fixup routine; any installation lacking those patches remains vulnerable.

Risk and Exploitability

The CVSS score is 8.1, indicating high severity, while the EPSS score is below 1%, implying a low but non-zero exploitation probability. The flaw is not listed in the CISA KEV catalog. Exploitation requires a malicious USB NetChip 1080 device physically connected to the target or placed in the data path; the attack vector is local and device-based. Once triggered, the out-of-bounds read can lead to a kernel panic and denial of service, but no remote code execution or privilege escalation is directly supported by the current description.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< f42217fa7d535e9ec4151f7971f06f6ea65e850a
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< c087749815379e9af2fdbeb08bfc33870b103958
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< e4a87126c085b097d29e17e3b7647295bba8be7c
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< 685e92934f11d5e215dad58813e2f9955ac2f436
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< 4dc8484be3302d187274364820d3bef6c62bde32
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< b153cfe84b1340c69a13d0957665a2bfcf21239c
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< ea866cab12db1a2100b400a8b03569e5bc0ee29a
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< 03f384bc0cb8d4a1301d4f5b0baef2d980258383

Linux

affected

Version	Status	Constraints
`2.6.14`	affected	—
`0`	unaffected	< 2.6.14
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[904813cd8a0b334189da285bb05af0b18b062502,f42217fa7d535e9ec4151f7971f06f6ea65e850a)`	affected	code_commit	—
`[904813cd8a0b334189da285bb05af0b18b062502,c087749815379e9af2fdbeb08bfc33870b103958)`	affected	code_commit	—
`[904813cd8a0b334189da285bb05af0b18b062502,e4a87126c085b097d29e17e3b7647295bba8be7c)`	affected	code_commit	—
`[904813cd8a0b334189da285bb05af0b18b062502,685e92934f11d5e215dad58813e2f9955ac2f436)`	affected	code_commit	—
`[904813cd8a0b334189da285bb05af0b18b062502,4dc8484be3302d187274364820d3bef6c62bde32)`	affected	code_commit	—
`[904813cd8a0b334189da285bb05af0b18b062502,b153cfe84b1340c69a13d0957665a2bfcf21239c)`	affected	code_commit	—
`[904813cd8a0b334189da285bb05af0b18b062502,ea866cab12db1a2100b400a8b03569e5bc0ee29a)`	affected	code_commit	—
`[904813cd8a0b334189da285bb05af0b18b062502,03f384bc0cb8d4a1301d4f5b0baef2d980258383)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`2.6.14`	affected	semver	—
`[0,2.6.14)`	unaffected	semver	—
`[5.10.261,5.10.*]`	unaffected	semver	—
`[5.15.212,5.15.*]`	unaffected	semver	—
`[6.1.178,6.1.*]`	unaffected	semver	—
`[6.6.145,6.6.*]`	unaffected	semver	—
`[6.12.97,6.12.*]`	unaffected	semver	—
`[6.18.40,6.18.*]`	unaffected	semver	—
`[7.1.5,7.1.*]`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	semver	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a release that includes the net1080_rx_fixup patch.
If the NetChip 1080 hardware is not required, unload or disable the usbnet module that provides the driver.
If the device is required, ensure it is sourced from a trusted vendor and that the kernel you run has incorporated the security fix.

Generated by OpenCVE AI on August 2, 2026 at 10:42 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Debian DSA	DSA-6405-1	linux security update

No CVSS v4.0

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00277.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/03f384bc0cb8d4a1301d4f5b0baef2d980258383
https://git.kernel.org/stable/c/4dc8484be3302d187274364820d3bef6c62bde32
https://git.kernel.org/stable/c/685e92934f11d5e215dad58813e2f9955ac2f436
https://git.kernel.org/stable/c/b153cfe84b1340c69a13d0957665a2bfcf21239c
https://git.kernel.org/stable/c/c087749815379e9af2fdbeb08bfc33870b103958
https://git.kernel.org/stable/c/e4a87126c085b097d29e17e3b7647295bba8be7c
https://git.kernel.org/stable/c/ea866cab12db1a2100b400a8b03569e5bc0ee29a
https://git.kernel.org/stable/c/f42217fa7d535e9ec4151f7971f06f6ea65e850a
https://lore.kernel.org/linux-cve-announce/2026072736-CVE-2026-64547-4deb@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64547
https://www.cve.org/CVERecord?id=CVE-2026-64547

History

Thu, 30 Jul 2026 06:15:00 +0000

Type	Values Removed	Values Added
Metrics	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}`	cvssV3_1 `{'score': 8.1, 'vector': 'CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H'}`

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026072736-CVE-2026-64547-4deb@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64547 https://www.cve.org/CVERecord?id=CVE-2026-64547
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Moderate`

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pad-byte access in rx_fixup For an even packet_len, net1080_rx_fixup() reads the pad byte at skb->data[packet_len] before the skb->len != packet_len check further down, and packet_len is only bounded against NC_MAX_PACKET. A malicious NetChip 1080 device can send a short frame advertising a large even packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the skb: BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14 ... net1080_rx_fixup (drivers/net/usb/net1080.c:384) usbnet_bh (drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3708) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) ... Reject the frame when packet_len >= skb->len before reading.
Title		net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/03f384bc0cb8d4a1301d4f5b0baef2d980258383 https://git.kernel.org/stable/c/4dc8484be3302d187274364820d3bef6c62bde32 https://git.kernel.org/stable/c/685e92934f11d5e215dad58813e2f9955ac2f436 https://git.kernel.org/stable/c/b153cfe84b1340c69a13d0957665a2bfcf21239c https://git.kernel.org/stable/c/c087749815379e9af2fdbeb08bfc33870b103958 https://git.kernel.org/stable/c/e4a87126c085b097d29e17e3b7647295bba8be7c https://git.kernel.org/stable/c/ea866cab12db1a2100b400a8b03569e5bc0ee29a https://git.kernel.org/stable/c/f42217fa7d535e9ec4151f7971f06f6ea65e850a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-27T20:10:37.786Z

Updated: 2026-08-05T12:42:53.882Z

Reserved: 2026-07-19T15:36:31.795Z

Link: CVE-2026-64547

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-27T21:17:07.427

Modified: 2026-07-30T06:25:58.463

Link: CVE-2026-64547

Redhat

Severity : Moderate

Publid Date: 2026-07-27T00:00:00Z

Links: CVE-2026-64547 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-02T10:45:03Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Adjacent Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object