The Linux kernel's virtio-net driver had a vulnerability due to an outdated received length check after a change in buffer allocation for large packets when guest GSO is off. Previously, buffer size was fixed at MAX_SKB_FRAGS * PAGE_SIZE, but now it depends on the negotiated MTU, with the number of allocated fragments stored in vi->big_packets_num_skbfrags. Because the host can announce a malicious buffer length (e.g., via a modified vhost_net driver), the receive path requires a length check adapted to this new allocation method. The missing or incorrect check could lead to a NULL page pointer dereference during packet reception, causing a potential denial of service and impacting confidentiality, integrity, and availability. This vulnerability was fixed by updating the length check to align with the new buffer allocation logic.

Exploitation of this vulnerability can lead to a NULL pointer dereference in the kernel, resulting in a denial of service (system crash). The CVSS vector indicates high impact on confidentiality, integrity, and availability. There is no evidence of known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no explicit patch or vendor advisory is provided, users should monitor official Linux kernel updates and apply the fix once available. Until then, cautious handling of virtio-net interfaces and limiting exposure to untrusted hosts is advisable.