CVE-2026-64527

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

drm/hyperv: validate VMBus packet size in receive callback

hyperv_receive_sub() reads msg->vid_hdr.type and dispatches into one

of four message-type branches without knowing how many bytes the host

wrote into hv->recv_buf. The completion path then runs

memcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that

wakes on wait_for_completion_timeout() can read up to 16 KiB of

residue from a prior message as if it were the response payload.

Pass bytes_recvd into hyperv_receive_sub() and reject any packet that

does not cover the pipe + synthvid header. A single switch on

msg->vid_hdr.type then computes the type-specific payload size: the

three completion-driving types (SYNTHVID_VERSION_RESPONSE,

SYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK) fall through

to a shared exit that requires that size before memcpy/complete, while

SYNTHVID_FEATURE_CHANGE validates its own payload and returns before

readin

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References