CVE-2026-53199

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf

netvsc_copy_to_send_buf() copies page buffer entries into the VMBus

send buffer using phys_to_virt() on the entry PFN. Entries for the

RNDIS header and the skb linear data come from kmalloc'd memory and

are always in the kernel direct map, but entries for skb fragments

reference page cache or user pages, which on 32-bit x86 with

CONFIG_HIGHMEM=y can live above the LOWMEM boundary. For such a page

phys_to_virt() returns an address outside the direct map and the

subsequent memcpy() faults on the transmit softirq path, which is

fatal.

Map the pages with kmap_local_page() instead, handling two properties

of the page buffer entries:

- pb[i].pfn is a Hyper-V PFN at HV_HYP_PAGE_SIZE (4K) granularity,

not a native PFN. Reconstruct the physical address first and derive

the native page from it, so the mapping stays correct where

PAGE_SIZE > HV_HYP_PAGE_SIZE

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References