CVE-2026-64550

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: validate MAP frame length before ingress parsing

When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes

the skb straight to __rmnet_map_ingress_handler(), skipping the length

validation that rmnet_map_deaggregate() performs on the aggregated path.

The parser then dereferences the MAP header and csum header/trailer based on

the on-wire pkt_len without checking skb->len, so a short frame is read out

of bounds:

BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet

Read of size 1 at addr ffff88801118ed00 by task exploit/147

Call Trace:

...

rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)

__rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)

rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)

__netif_receive_skb_core.constprop.0 (net/core/dev.c:

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References