The bug in virtio‑net’s receive_big function causes the driver to allow a device‑announced length that exceeds the actually advertised size. When a malicious virtio backend supplies a length in the unused gap, the kernel’s page_to_skb routine walks past the allowed page chain, writing to skb_shinfo()->frags[MAX_SKB_FRAGS]. This out‑of‑bounds write stores a NULL page->private pointer and propagates a NULL fragment up the receive path, potentially corrupting kernel data structures or enabling arbitrary write capabilities. As the problem resides in the kernel, any successful exploitation could lead to kernel panic, privilege escalation, or denial of service.

All Linux kernel releases that contain the original virtio‑net implementation but lack the commit that bounds the length to the value advertised by add_recvbuf_big are affected. The vulnerability applies to systems running virtio back‑end drivers that can supply arbitrary length values to the host, typically virtualization environments exposing virtio devices.

The CVSS score is 8.4, indicating a high severity vulnerability. The EPSS score is < 1%, suggesting a low but non‑zero probability of exploitation in the wild. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires a malicious virtio backend or a compromised virtual environment, so the attack vector is likely limited to controlled or malicious virtual guests. No public exploit has been reported; however, the kernel‑level nature of the flaw allows for privilege escalation, making it a significant risk for affected systems.