CVE-2026-64547 - Vulnerability Details

- net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

Description

In the Linux kernel, the following vulnerability has been resolved:

net: usb: net1080: validate packet_len before pad-byte access in rx_fixup

For an even packet_len, net1080_rx_fixup() reads the pad byte at
skb->data[packet_len] before the skb->len != packet_len check further
down, and packet_len is only bounded against NC_MAX_PACKET. A malicious
NetChip 1080 device can send a short frame advertising a large even
packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the
skb:

BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup
Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14
...
net1080_rx_fixup (drivers/net/usb/net1080.c:384)
usbnet_bh (drivers/net/usb/usbnet.c:1589)
process_one_work (kernel/workqueue.c:3322)
bh_worker (kernel/workqueue.c:3708)
tasklet_action (kernel/softirq.c:965)
handle_softirqs (kernel/softirq.c:622)
...

Reject the frame when packet_len >= skb->len before reading.

Published: 2026-07-27

Score: n/a

EPSS: n/a

KEV: No

Impact:

Action:

Analysis

Analysis and contextual insights are available on OpenCVE Cloud.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< f42217fa7d535e9ec4151f7971f06f6ea65e850a
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< c087749815379e9af2fdbeb08bfc33870b103958
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< e4a87126c085b097d29e17e3b7647295bba8be7c
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< 685e92934f11d5e215dad58813e2f9955ac2f436
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< 4dc8484be3302d187274364820d3bef6c62bde32
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< b153cfe84b1340c69a13d0957665a2bfcf21239c
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< ea866cab12db1a2100b400a8b03569e5bc0ee29a
`904813cd8a0b334189da285bb05af0b18b062502`	affected	< 03f384bc0cb8d4a1301d4f5b0baef2d980258383

Linux

affected

Version	Status	Constraints
`2.6.14`	affected	—
`0`	unaffected	< 2.6.14
`5.10.261`	unaffected	≤ 5.10.*
`5.15.212`	unaffected	≤ 5.15.*
`6.1.178`	unaffected	≤ 6.1.*
`6.6.145`	unaffected	≤ 6.6.*
`6.12.97`	unaffected	≤ 6.12.*
`6.18.40`	unaffected	≤ 6.18.*
`7.1.5`	unaffected	≤ 7.1.*
`7.2-rc3`	unaffected	≤ *

No data.

No data available yet.

Remediation

No vendor fix or workaround currently provided.

Additional remediation guidance may be available on OpenCVE Cloud.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

No EPSS score available.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/03f384bc0cb8d4a1301d4f5b0baef2d980258383
https://git.kernel.org/stable/c/4dc8484be3302d187274364820d3bef6c62bde32
https://git.kernel.org/stable/c/685e92934f11d5e215dad58813e2f9955ac2f436
https://git.kernel.org/stable/c/b153cfe84b1340c69a13d0957665a2bfcf21239c
https://git.kernel.org/stable/c/c087749815379e9af2fdbeb08bfc33870b103958
https://git.kernel.org/stable/c/e4a87126c085b097d29e17e3b7647295bba8be7c
https://git.kernel.org/stable/c/ea866cab12db1a2100b400a8b03569e5bc0ee29a
https://git.kernel.org/stable/c/f42217fa7d535e9ec4151f7971f06f6ea65e850a

History

Mon, 27 Jul 2026 20:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: net: usb: net1080: validate packet_len before pad-byte access in rx_fixup For an even packet_len, net1080_rx_fixup() reads the pad byte at skb->data[packet_len] before the skb->len != packet_len check further down, and packet_len is only bounded against NC_MAX_PACKET. A malicious NetChip 1080 device can send a short frame advertising a large even packet_len (e.g. 0x4000), so the pad-byte read lands past the end of the skb: BUG: KASAN: slab-out-of-bounds in net1080_rx_fixup Read of size 1 at addr ffff8880106c83c6 by task ksoftirqd/0/14 ... net1080_rx_fixup (drivers/net/usb/net1080.c:384) usbnet_bh (drivers/net/usb/usbnet.c:1589) process_one_work (kernel/workqueue.c:3322) bh_worker (kernel/workqueue.c:3708) tasklet_action (kernel/softirq.c:965) handle_softirqs (kernel/softirq.c:622) ... Reject the frame when packet_len >= skb->len before reading.
Title		net: usb: net1080: validate packet_len before pad-byte access in rx_fixup
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/03f384bc0cb8d4a1301d4f5b0baef2d980258383 https://git.kernel.org/stable/c/4dc8484be3302d187274364820d3bef6c62bde32 https://git.kernel.org/stable/c/685e92934f11d5e215dad58813e2f9955ac2f436 https://git.kernel.org/stable/c/b153cfe84b1340c69a13d0957665a2bfcf21239c https://git.kernel.org/stable/c/c087749815379e9af2fdbeb08bfc33870b103958 https://git.kernel.org/stable/c/e4a87126c085b097d29e17e3b7647295bba8be7c https://git.kernel.org/stable/c/ea866cab12db1a2100b400a8b03569e5bc0ee29a https://git.kernel.org/stable/c/f42217fa7d535e9ec4151f7971f06f6ea65e850a

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-27T20:10:37.786Z

Updated: 2026-07-27T20:10:37.786Z

Reserved: 2026-07-19T15:36:31.795Z

Link: CVE-2026-64547

Vulnrichment

No data.

NVD

No data.

Redhat

No data.

OpenCVE Enrichment

No data.

Weaknesses

No weakness.

Tracking

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object