CVE-2026-64547

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

For an even packet_len, net1080_rx_fixup() reads the pad byte at

skb->data[packet_len] before the skb->len != packet_len check further

down, and packet_len is only bounded against NC_MAX_PACKET. A malicious

NetChip 1080 device can send a short frame advertising a large even

packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the

skb:

BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup

Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14

...

net1080_rx_fixup (drivers/net/usb/net1080.c:384)

usbnet_bh (drivers/net/usb/usbnet.c:1589)

process_one_work (kernel/workqueue.c:3322)

bh_worker (kernel/workqueue.c:3708)

tasklet_action (kernel/softirq.c:965)

handle_softirqs (kernel/softirq.c:622)

...

Reject the frame when packet_len >= skb->len before reading.

Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

References