The vulnerability (CVE-2026-64552) in the Linux kernel's virtio-net driver stems from receive_big() improperly bounding the device-announced length. The check allowed a length larger than the actual buffer size due to a miscalculation involving the offset of sg[1] and the size of the padded_vnet_hdr structure. A malicious virtio backend could exploit this gap to cause page_to_skb() to walk one fragment past the page chain, resulting in an out-of-bounds write and a NULL fragment being passed up the receive path. This can cause memory corruption and potentially lead to system compromise.

Successful exploitation can lead to an out-of-bounds write and NULL pointer dereference in the kernel, impacting confidentiality, integrity, and availability of the system. The CVSS score of 8.4 reflects a high severity with local attack vector, low complexity, no privileges required, and no user interaction needed.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or fix link is provided, users should monitor official Linux kernel security advisories for updates addressing this vulnerability. Until patched, avoid exposure to untrusted virtio backends.