CVE-2026-64550 - Vulnerability Details

- net: qualcomm: rmnet: validate MAP frame length before ingress parsing

Description

In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: validate MAP frame length before ingress parsing

When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes
the skb straight to __rmnet_map_ingress_handler(), skipping the length
validation that rmnet_map_deaggregate() performs on the aggregated path.
The parser then dereferences the MAP header and csum header/trailer based on
the on-wire pkt_len without checking skb->len, so a short frame is read out
of bounds:

BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet
Read of size 1 at addr ffff88801118ed00 by task exploit/147
Call Trace:
...
rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)
__rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)
rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)
__netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)
netif_receive_skb (net/core/dev.c:6460)
tun_get_user (drivers/net/tun.c:1955)
tun_chr_write_iter (drivers/net/tun.c:2001)
vfs_write (fs/read_write.c:688)
ksys_write (fs/read_write.c:740)
do_syscall_64 (arch/x86/entry/syscall_64.c:94)
...

Factor that validation out of rmnet_map_deaggregate() into
rmnet_map_validate_packet_len() and run it on the no-aggregation path too.
The MAP header is bounds-checked first, since this path can receive a frame
shorter than the header.

Published: 2026-07-27

Score: 7.3 High

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

The vulnerability is an out‑of‑bounds read, classified under CWE‑125. A crafted Qualcomm MAP frame can bypass length validation on the non‑aggregated ingress path of the Linux RMNET driver. The driver parses the MAP header and checksum using the on‑wire packet length without checking the skb buffer length, causing an out‑of‑bounds read. This memory corruption can crash the kernel or, if the attacker can control the packet, potentially lead to privilege escalation.

Affected Systems

The vulnerability affects all Linux kernel releases that include the rmnet driver before the latest security patch. It is present in the Qualcomm RMNET subsystem, specifically the functions that handle ingress MAP frame parsing, including rmnet_map_ingress_handler and rmnet_rx_handler. Any installation that uses the rmnet driver without the patch is considered vulnerable.

Risk and Exploitability

The EPSS score is below 1%, indicating a low but non‑zero likelihood of exploitation. The CVSS score is 7.3, reflecting a medium‑to‑high severity vulnerability, and the issue is not listed in CISA’s KEV catalog. An attacker can trigger the flaw by sending a malformed MAP frame over an interface that routes traffic for the RMNET subsystem. No user interaction is required, and the attack can be carried out from a remote host with network access.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< ed25befc8c36f896b5878f9078faddb67fd7e2d0
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< a54d76d176e50d2fdbd39b7231efe256170339e4
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< 00f4c366dbca16a40772c3b7ec2d8cba839e9724
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< 3868c3244369ab709a90c9aad7534d406009b824
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< 14eb0c9491385d5361a292ea4974aec0e6887299
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< 1b12612c367e4be9b0814c0468e7e687835315b4
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< 231a8a4b76cb1b1827b3b19d7b3603642f5aaaef
`ceed73a2cf4aff2921802aa3d21d45280677547d`	affected	< f0f1887a9e30712a1df03e152dce6fb91344b1f3

Linux

affected

Version	Status	Constraints
`4.14`	affected	—
`0`	unaffected	< 4.14
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[ceed73a2cf4aff2921802aa3d21d45280677547d,ed25befc8c36f896b5878f9078faddb67fd7e2d0)`	affected	code_commit	—
`[ceed73a2cf4aff2921802aa3d21d45280677547d,a54d76d176e50d2fdbd39b7231efe256170339e4)`	affected	code_commit	—
`[ceed73a2cf4aff2921802aa3d21d45280677547d,00f4c366dbca16a40772c3b7ec2d8cba839e9724)`	affected	code_commit	—
`[ceed73a2cf4aff2921802aa3d21d45280677547d,3868c3244369ab709a90c9aad7534d406009b824)`	affected	code_commit	—
`[ceed73a2cf4aff2921802aa3d21d45280677547d,14eb0c9491385d5361a292ea4974aec0e6887299)`	affected	code_commit	—
`[ceed73a2cf4aff2921802aa3d21d45280677547d,1b12612c367e4be9b0814c0468e7e687835315b4)`	affected	code_commit	—
`[ceed73a2cf4aff2921802aa3d21d45280677547d,231a8a4b76cb1b1827b3b19d7b3603642f5aaaef)`	affected	code_commit	—
`[ceed73a2cf4aff2921802aa3d21d45280677547d,f0f1887a9e30712a1df03e152dce6fb91344b1f3)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`4.14`	affected	semver	—
`[0,4.14)`	unaffected	semver	—
`[5.10.261,5.11.0)`	unaffected	semver	—
`[5.15.212,5.16.0)`	unaffected	semver	—
`[6.1.178,6.2.0)`	unaffected	semver	—
`[6.6.145,6.7.0)`	unaffected	semver	—
`[6.12.97,6.13.0)`	unaffected	semver	—
`[6.18.40,6.19.0)`	unaffected	semver	—
`[7.1.5,7.2.0)`	unaffected	semver	—
`[7.2-rc3,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Upgrade the Linux kernel to a version that includes the patched rmnet driver. This is the sole official fix.
If the RMNET functionality is unnecessary, disable the rmnet driver or related modules to eliminate the attack surface.
Bind the RMNET interface to a trusted network segment or apply firewall rules that block anomalous MAP packets, reducing the risk of exploit delivery.

Generated by OpenCVE AI on August 2, 2026 at 10:41 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4717-1	linux security update
Debian DLA	DLA-4720-1	linux security update
Debian DLA	DLA-4723-1	linux-6.1 security update
Debian DLA	DLA-4724-1	linux-6.12 new package
Debian DSA	DSA-6405-1	linux security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00126.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/00f4c366dbca16a40772c3b7ec2d8cba839e9724
https://git.kernel.org/stable/c/14eb0c9491385d5361a292ea4974aec0e6887299
https://git.kernel.org/stable/c/1b12612c367e4be9b0814c0468e7e687835315b4
https://git.kernel.org/stable/c/231a8a4b76cb1b1827b3b19d7b3603642f5aaaef
https://git.kernel.org/stable/c/3868c3244369ab709a90c9aad7534d406009b824
https://git.kernel.org/stable/c/a54d76d176e50d2fdbd39b7231efe256170339e4
https://git.kernel.org/stable/c/ed25befc8c36f896b5878f9078faddb67fd7e2d0
https://git.kernel.org/stable/c/f0f1887a9e30712a1df03e152dce6fb91344b1f3
https://lore.kernel.org/linux-cve-announce/2026072737-CVE-2026-64550-e84a@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64550
https://www.cve.org/CVERecord?id=CVE-2026-64550

History

Thu, 30 Jul 2026 06:15:00 +0000

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 7.3, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H'}`

Wed, 29 Jul 2026 12:15:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-125
References		https://lore.kernel.org/linux-cve-announce/2026072737-CVE-2026-64550-e84a@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64550 https://www.cve.org/CVERecord?id=CVE-2026-64550

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: qualcomm: rmnet: validate MAP frame length before ingress parsing When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handler(), skipping the length validation that rmnet_map_deaggregate() performs on the aggregated path. The parser then dereferences the MAP header and csum header/trailer based on the on-wire pkt_len without checking skb->len, so a short frame is read out of bounds: BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet Read of size 1 at addr ffff88801118ed00 by task exploit/147 Call Trace: ... rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413) __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96) rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129) __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089) netif_receive_skb (net/core/dev.c:6460) tun_get_user (drivers/net/tun.c:1955) tun_chr_write_iter (drivers/net/tun.c:2001) vfs_write (fs/read_write.c:688) ksys_write (fs/read_write.c:740) do_syscall_64 (arch/x86/entry/syscall_64.c:94) ... Factor that validation out of rmnet_map_deaggregate() into rmnet_map_validate_packet_len() and run it on the no-aggregation path too. The MAP header is bounds-checked first, since this path can receive a frame shorter than the header.
Title		net: qualcomm: rmnet: validate MAP frame length before ingress parsing
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/00f4c366dbca16a40772c3b7ec2d8cba839e9724 https://git.kernel.org/stable/c/14eb0c9491385d5361a292ea4974aec0e6887299 https://git.kernel.org/stable/c/1b12612c367e4be9b0814c0468e7e687835315b4 https://git.kernel.org/stable/c/231a8a4b76cb1b1827b3b19d7b3603642f5aaaef https://git.kernel.org/stable/c/3868c3244369ab709a90c9aad7534d406009b824 https://git.kernel.org/stable/c/a54d76d176e50d2fdbd39b7231efe256170339e4 https://git.kernel.org/stable/c/ed25befc8c36f896b5878f9078faddb67fd7e2d0 https://git.kernel.org/stable/c/f0f1887a9e30712a1df03e152dce6fb91344b1f3

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-27T20:10:39.459Z

Updated: 2026-08-05T12:42:56.021Z

Reserved: 2026-07-19T15:36:31.796Z

Link: CVE-2026-64550

Vulnrichment

No data.

NVD

Status : Received

Published: 2026-07-27T21:17:07.867

Modified: 2026-07-30T06:25:58.720

Link: CVE-2026-64550

Redhat

Severity :

Publid Date: 2026-07-27T00:00:00Z

Links: CVE-2026-64550 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-02T10:45:03Z

Weaknesses

CWE-125
Out-of-bounds Read

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact High

Integrity Impact Low

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object