The Linux kernel's virtio-net driver had a vulnerability (CVE-2026-64552) in the receive_big() function where the length check was insufficiently strict. The function bounded the device-announced length by (big_packets_num_skbfrags + 1) * PAGE_SIZE, but add_recvbuf_big() actually set the scatter-gather list starting at an offset within the first page, effectively reducing the usable buffer size by about 20 bytes for the common header length. This discrepancy allowed a malicious virtio backend to announce a length within this gap, causing page_to_skb() to walk one fragment past the page chain. This led to an out-of-bounds write of a NULL page->private pointer into skb_shinfo()->frags[MAX_SKB_FRAGS], resulting in memory corruption and a NULL fragment being passed up the receive path. The fix involved bounding the length by the actual size advertised by add_recvbuf_big().

This vulnerability allows a malicious virtio backend to cause an out-of-bounds write in the kernel memory, potentially leading to memory corruption. The impact includes confidentiality, integrity, and availability violations as indicated by the CVSS vector (C:H/I:H/A:H). This could result in system crashes or exploitation to compromise the kernel.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using untrusted virtio backends or isolate affected systems from untrusted virtual device sources. Monitor vendor channels for updates and apply patches promptly once released.