net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pad-byte access in rx_fixup For an even packet_len, net1080_rx_fixup() reads the pad byte at skb->data[packet_len] before the skb->len != packet_len check further down, and packet_len is only bounded against NC_MAX_PACKET. A malicious NetChip 1080 device can send a short frame advertising a large even packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the skb: BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14 ... net1080_rx_fixup (drivers/net/usb/net1080.c:384) usbnet_bh (drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3708) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) ... Reject the frame when packet_len >= skb->len before reading.
CVE-2026-64547
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: cve:CVE-2026-64547
Linux
Source reference: /containers/cna/affected/0/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Linux
Source reference: /containers/cna/affected/1/product
- Affected versions
- Not stated in this record
- Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"lessThan": "f42217fa7d535e9ec4151f7971f06f6ea65e850a",
"versionType": "git"
},
{
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"lessThan": "c087749815379e9af2fdbeb08bfc33870b103958",
"versionType": "git"
},
{
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"lessThan": "e4a87126c085b097d29e17e3b7647295bba8be7c",
"versionType": "git"
},
{
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"lessThan": "685e92934f11d5e215dad58813e2f9955ac2f436",
"versionType": "git"
},
{
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"lessThan": "4dc8484be3302d187274364820d3bef6c62bde32",
"versionType": "git"
},
{
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"lessThan": "b153cfe84b1340c69a13d0957665a2bfcf21239c",
"versionType": "git"
},
{
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"lessThan": "ea866cab12db1a2100b400a8b03569e5bc0ee29a",
"versionType": "git"
},
{
"status": "affected",
"version": "904813cd8a0b334189da285bb05af0b18b062502",
"lessThan": "03f384bc0cb8d4a1301d4f5b0baef2d980258383",
"versionType": "git"
}
],
"programFiles": [
"drivers/net/usb/net1080.c"
],
"defaultStatus": "unaffected"
},
{
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"vendor": "Linux",
"product": "Linux",
"versions": [
{
"status": "affected",
"version": "2.6.14"
},
{
"status": "unaffected",
"version": "0",
"lessThan": "2.6.14",
"versionType": "semver"
},
{
"status": "unaffected",
"version": "5.10.261",
"versionType": "semver",
"lessThanOrEqual": "5.10.*"
},
{
"status": "unaffected",
"version": "5.15.212",
"versionType": "semver",
"lessThanOrEqual": "5.15.*"
},
{
"status": "unaffected",
"version": "6.1.178",
"versionType": "semver",
"lessThanOrEqual": "6.1.*"
},
{
"status": "unaffected",
"version": "6.6.145",
"versionType": "semver",
"lessThanOrEqual": "6.6.*"
},
{
"status": "unaffected",
"version": "6.12.97",
"versionType": "semver",
"lessThanOrEqual": "6.12.*"
},
{
"status": "unaffected",
"version": "6.18.40",
"versionType": "semver",
"lessThanOrEqual": "6.18.*"
},
{
"status": "unaffected",
"version": "7.1.5",
"versionType": "semver",
"lessThanOrEqual": "7.1.*"
},
{
"status": "unaffected",
"version": "7.2",
"versionType": "original_commit_for_fix",
"lessThanOrEqual": "*"
}
],
"programFiles": [
"drivers/net/usb/net1080.c"
],
"defaultStatus": "affected"
}
]- Related CVEs
- CVE-2026-64547
Source reference:
/cveMetadata/cveId
Publisher severity
high
Source reference: /containers/cna/metrics
- Event
- #41078 · Revision 1
- Added to Heist Feed
- Publisher date