Linux kernel virtio-net: malicious host-announced buffer length causes NULL page dereference in guest

Impact

Since the switch to MTU-sized buffers for big packets, the guest's receive path validated the host-announced length against the old MAX_SKB_FRAGS * PAGE_SIZE assumption instead of the actual allocation recorded in vi->big_packets_num_skbfrags. A host-side vhost_net that announces a length larger than what the guest allocated walks the guest off the end of its frag list and dereferences a NULL page pointer. On a GPU fleet this is a host-to-guest integrity break: a compromised or malicious hypervisor-side backend can crash or corrupt memory in a guest VM that may hold passed-through GPUs, and the guest kernel panic takes the GPU workloads on that VM with it. It matters for anyone renting GPU VMs where the virtio backend is not in the tenant's trust boundary, and for nested or multi-layer virtualization setups.

Who can reach it

Requires control of the virtio-net host backend (a modified vhost_net get_rx_bufs) facing the guest; no guest authentication involved. Not reachable by an unprivileged guest user or over the network.

What to do

Apply the stable kernel update containing the corrected receive length check (five stable branches carry the fix; see the git.kernel.org commits in the references) and reboot each affected guest - or host, where the host kernel is the one running virtio-net. No configuration-level mitigation is published; guests using guest-GSO-on configurations are less exposed because the old allocation path applies. Expect a node reboot per affected machine, so fold it into the next kernel maintenance window rather than treating it as a hot patch.

References

Related entries

• Linux kernel sockmap: bpf_msg_push_data mis-advances split fragment offset, corrupting scatterlist layoutCVE-2026-63926 · Linux kernel bpf sockmap (bpf_msg_push_data fragment offset)High
• Linux kernel arm_ffa: unvalidated notification layout drives out-of-bounds read of the shared RX bufferCVE-2026-64081 · Linux kernel arm_ffa (Arm FF-A framework notification parsing)High
• Linux kernel (arch/x86/kvm): A nested guest can put an out-of-range virtual-processor ID into an enlightened VMCS andCVE-2026-64247 · Linux kernel (arch/x86/kvm)High
• Linux kernel sockmap: integer overflow in bpf_msg_push_data allocation leads to out-of-bounds memcpyCVE-2026-64548 · Linux kernel bpf sockmap (bpf_msg_push_data copy+len integer overflow)High
• Linux kernel virtio-net: loose length check in receive_big() lets a malicious backend write past the frag arrayCVE-2026-64552 · Linux kernel virtio-net (receive_big() length validation)High
• Linux kernel sockmap: 32-bit wrap in bpf_msg_pop_data bounds check runs the pop loop off the scatterlistCVE-2026-74256 · Linux kernel bpf sockmap (bpf_msg_pop_data bounds check overflow)High