The Linux kernel Qualcomm rmnet driver had a vulnerability (CVE-2026-64550) where, if ingress deaggregation was disabled, the rmnet_map_ingress_handler() function bypassed length validation performed by rmnet_map_deaggregate(). This caused the parser to dereference MAP and checksum headers based on on-wire packet length without verifying the actual skb buffer length, leading to out-of-bounds memory reads and a slab-out-of-bounds bug detected by KASAN. The fix involved refactoring the length validation into rmnet_map_validate_packet_len() and applying it to the no-aggregation ingress path to prevent processing frames shorter than the header.

This vulnerability allows an attacker with local privileges to cause out-of-bounds memory reads in kernel space, potentially leading to memory corruption. The CVSS vector indicates high confidentiality impact, low integrity impact, and high availability impact. Exploitation could result in denial of service or information disclosure. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to validate MAP frame length on all ingress paths, including when ingress deaggregation is disabled. Users should apply the official kernel updates that include this patch. Since this is a kernel vulnerability, updating to a fixed kernel version is the recommended remediation. Patch status is not explicitly confirmed here; check the vendor or Linux kernel advisories for the specific fixed versions and apply updates accordingly.