The Linux kernel vulnerability CVE-2026-64527 concerns the drm/hyperv driver where the hyperv_receive_sub() function did not properly validate the size of VMBus packets before processing. This led to a scenario where memcpy could copy up to 16 KiB of residual data from previous messages due to unbounded copying based on the packet size. The patch introduces passing the actual bytes received into hyperv_receive_sub(), validating that packets cover the expected header and payload sizes, rejecting unknown or malformed packet types, and ensuring memcpy only copies the validated number of bytes after a successful receive. Additionally, rejected packets are logged for visibility rather than silently dropped.

The vulnerability could allow reading of residual data from previous messages in the buffer, potentially leading to information disclosure within the context of the hyperv driver in the Linux kernel. There is no indication of remote code execution or privilege escalation. The impact is limited to exposure of unintended data in memory buffers during VMBus communication.

A fix has been implemented in the Linux kernel to validate VMBus packet sizes in the hyperv_receive_sub() callback, reject malformed packets, and log rejected packets. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel-level vulnerability, updating to the fixed kernel version is the recommended remediation. Patch status is not explicitly stated in the provided data; users should consult the vendor or Linux kernel advisory for the exact fixed versions and update accordingly.