CVE-2026-64527

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-64527", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2026-07-19T15:36:31.794Z", "datePublished": "2026-07-25T09:20:51.078Z", "dateUpdated": "2026-07-25T09:20:51.078Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-07-25T09:20:51.078Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/hyperv: validate VMBus packet size in receive callback\n\nhyperv_receive_sub() reads msg->vid_hdr.type and dispatches into one\nof four message-type branches without knowing how many bytes the host\nwrote into hv->recv_buf. The completion path then runs\nmemcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that\nwakes on wait_for_completion_timeout() can read up to 16 KiB of\nresidue from a prior message as if it were the response payload.\n\nPass bytes_recvd into hyperv_receive_sub() and reject any packet that\ndoes not cover the pipe + synthvid header. A single switch on\nmsg->vid_hdr.type then computes the type-specific payload size: the\nthree completion-driving types (SYNTHVID_VERSION_RESPONSE,\nSYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK) fall through\nto a shared exit that requires that size before memcpy/complete, while\nSYNTHVID_FEATURE_CHANGE validates its own payload and returns before\nreading is_dirt_needed. Unknown types are dropped.\n\nSYNTHVID_RESOLUTION_RESPONSE is variable length: the host fills\nresolution_count entries, not the full SYNTHVID_MAX_RESOLUTION_COUNT\narray. Validate the fixed prefix first so resolution_count can be\nread, bound it against the array, then require only the count-sized\narray, so the shorter responses the host actually sends are accepted.\n\nOnly run the sub-handler when vmbus_recvpacket() returned success. The\nmemcpy length is bytes_recvd, which is bounded by VMBUS_MAX_PACKET_SIZE\nonly on a successful receive; on -ENOBUFS vmbus_recvpacket() instead\nreports the required length, which can exceed hv->recv_buf, so copying\nbytes_recvd would read and write past the 16 KiB buffers. Gating on the\nsuccess return keeps the copy bounded. The nonzero-return path is itself\na malformed-message case and is now logged rather than silently skipped;\nchannel recovery is not attempted.\n\nRejected packets are reported via drm_err_ratelimited() rather than\nsilently dropped, matching the CoCo-hardened pattern in\nhv_kvp_onchannelcallback()."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/hyperv/hyperv_drm_proto.c"], "versions": [{"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0", "lessThan": "57d5d697642e05d5dd2d40660817765943dd709f", "status": "affected", "versionType": "git"}, {"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0", "lessThan": "f5251226551bfec98c4705641b6f94ff1f238d91", "status": "affected", "versionType": "git"}, {"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0", "lessThan": "049a6b474823049fe60212f25f26e4b30f44ee8f", "status": "affected", "versionType": "git"}, {"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0", "lessThan": "588c84b461393ff1998ac7b97b04f953f642e0df", "status": "affected", "versionType": "git"}, {"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0", "lessThan": "164dc7bf17609340233c6bf4f66bb7c7008a0511", "status": "affected", "versionType": "git"}, {"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0", "lessThan": "c8974d96b6a5496f33dc69a3ce28a7bf5078def4", "status": "affected", "versionType": "git"}, {"version": "76c56a5affeba1e163b66b9d8cc192e6154466f0", "lessThan": "7f87763f47a3c22fb50265a00619ef10f2394b18", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["drivers/gpu/drm/hyperv/hyperv_drm_proto.c"], "versions": [{"version": "5.14", "status": "affected"}, {"version": "0", "lessThan": "5.14", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.210", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.176", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.143", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.12.93", "lessThanOrEqual": "6.12.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.18.35", "lessThanOrEqual": "6.18.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.0.12", "lessThanOrEqual": "7.0.*", "status": "unaffected", "versionType": "semver"}, {"version": "7.1", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "5.15.210"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.1.176"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.6.143"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.12.93"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "6.18.35"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.0.12"}, {"vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "5.14", "versionEndExcluding": "7.1"}]}]}], "references": [{"url": "https://git.kernel.org/stable/c/57d5d697642e05d5dd2d40660817765943dd709f"}, {"url": "https://git.kernel.org/stable/c/f5251226551bfec98c4705641b6f94ff1f238d91"}, {"url": "https://git.kernel.org/stable/c/049a6b474823049fe60212f25f26e4b30f44ee8f"}, {"url": "https://git.kernel.org/stable/c/588c84b461393ff1998ac7b97b04f953f642e0df"}, {"url": "https://git.kernel.org/stable/c/164dc7bf17609340233c6bf4f66bb7c7008a0511"}, {"url": "https://git.kernel.org/stable/c/c8974d96b6a5496f33dc69a3ce28a7bf5078def4"}, {"url": "https://git.kernel.org/stable/c/7f87763f47a3c22fb50265a00619ef10f2394b18"}], "title": "drm/hyperv: validate VMBus packet size in receive callback", "x_generator": {"engine": "bippy-1.2.0"}}}}

{}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Linux", "programFiles": ["drivers/gpu/drm/hyperv/hyperv_drm_proto.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"lessThan": "57d5d697642e05d5dd2d40660817765943dd709f", "status": "affected", "version": "76c56a5affeba1e163b66b9d8cc192e6154466f0", "versionType": "git"}, {"lessThan": "f5251226551bfec98c4705641b6f94ff1f238d91", "status": "affected", "version": "76c56a5affeba1e163b66b9d8cc192e6154466f0", "versionType": "git"}, {"lessThan": "049a6b474823049fe60212f25f26e4b30f44ee8f", "status": "affected", "version": "76c56a5affeba1e163b66b9d8cc192e6154466f0", "versionType": "git"}, {"lessThan": "588c84b461393ff1998ac7b97b04f953f642e0df", "status": "affected", "version": "76c56a5affeba1e163b66b9d8cc192e6154466f0", "versionType": "git"}, {"lessThan": "164dc7bf17609340233c6bf4f66bb7c7008a0511", "status": "affected", "version": "76c56a5affeba1e163b66b9d8cc192e6154466f0", "versionType": "git"}, {"lessThan": "c8974d96b6a5496f33dc69a3ce28a7bf5078def4", "status": "affected", "version": "76c56a5affeba1e163b66b9d8cc192e6154466f0", "versionType": "git"}, {"lessThan": "7f87763f47a3c22fb50265a00619ef10f2394b18", "status": "affected", "version": "76c56a5affeba1e163b66b9d8cc192e6154466f0", "versionType": "git"}]}, {"defaultStatus": "affected", "product": "Linux", "programFiles": ["drivers/gpu/drm/hyperv/hyperv_drm_proto.c"], "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "versions": [{"status": "affected", "version": "5.14"}, {"lessThan": "5.14", "status": "unaffected", "version": "0", "versionType": "semver"}, {"lessThanOrEqual": "5.15.*", "status": "unaffected", "version": "5.15.210", "versionType": "semver"}, {"lessThanOrEqual": "6.1.*", "status": "unaffected", "version": "6.1.176", "versionType": "semver"}, {"lessThanOrEqual": "6.6.*", "status": "unaffected", "version": "6.6.143", "versionType": "semver"}, {"lessThanOrEqual": "6.12.*", "status": "unaffected", "version": "6.12.93", "versionType": "semver"}, {"lessThanOrEqual": "6.18.*", "status": "unaffected", "version": "6.18.35", "versionType": "semver"}, {"lessThanOrEqual": "7.0.*", "status": "unaffected", "version": "7.0.12", "versionType": "semver"}, {"lessThanOrEqual": "*", "status": "unaffected", "version": "7.1", "versionType": "original_commit_for_fix"}]}], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/hyperv: validate VMBus packet size in receive callback\n\nhyperv_receive_sub() reads msg->vid_hdr.type and dispatches into one\nof four message-type branches without knowing how many bytes the host\nwrote into hv->recv_buf. The completion path then runs\nmemcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that\nwakes on wait_for_completion_timeout() can read up to 16 KiB of\nresidue from a prior message as if it were the response payload.\n\nPass bytes_recvd into hyperv_receive_sub() and reject any packet that\ndoes not cover the pipe + synthvid header. A single switch on\nmsg->vid_hdr.type then computes the type-specific payload size: the\nthree completion-driving types (SYNTHVID_VERSION_RESPONSE,\nSYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK) fall through\nto a shared exit that requires that size before memcpy/complete, while\nSYNTHVID_FEATURE_CHANGE validates its own payload and returns before\nreading is_dirt_needed. Unknown types are dropped.\n\nSYNTHVID_RESOLUTION_RESPONSE is variable length: the host fills\nresolution_count entries, not the full SYNTHVID_MAX_RESOLUTION_COUNT\narray. Validate the fixed prefix first so resolution_count can be\nread, bound it against the array, then require only the count-sized\narray, so the shorter responses the host actually sends are accepted.\n\nOnly run the sub-handler when vmbus_recvpacket() returned success. The\nmemcpy length is bytes_recvd, which is bounded by VMBUS_MAX_PACKET_SIZE\nonly on a successful receive; on -ENOBUFS vmbus_recvpacket() instead\nreports the required length, which can exceed hv->recv_buf, so copying\nbytes_recvd would read and write past the 16 KiB buffers. Gating on the\nsuccess return keeps the copy bounded. The nonzero-return path is itself\na malformed-message case and is now logged rather than silently skipped;\nchannel recovery is not attempted.\n\nRejected packets are reported via drm_err_ratelimited() rather than\nsilently dropped, matching the CoCo-hardened pattern in\nhv_kvp_onchannelcallback()."}], "id": "CVE-2026-64527", "lastModified": "2026-11-03T18:15:39.353", "metrics": {}, "published": "2026-07-25T10:17:39.053", "references": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/049a6b474823049fe60212f25f26e4b30f44ee8f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/164dc7bf17609340233c6bf4f66bb7c7008a0511"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/57d5d697642e05d5dd2d40660817765943dd709f"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/588c84b461393ff1998ac7b97b04f953f642e0df"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/7f87763f47a3c22fb50265a00619ef10f2394b18"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/c8974d96b6a5496f33dc69a3ce28a7bf5078def4"}, {"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "url": "https://git.kernel.org/stable/c/f5251226551bfec98c4705641b6f94ff1f238d91"}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "vulnStatus": "Awaiting Analysis"}

{"bugzilla": {"description": "kernel: drm/hyperv: validate VMBus packet size in receive callback", "id": "2507077", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2507077"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.0", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-805", "details": ["A flaw was found in the `drm/hyperv` component of the Linux kernel. The `hyperv_receive_sub()` function, responsible for processing VMBus packets, does not adequately validate the size of incoming data. This oversight allows a malicious or compromised host to send specially crafted packets, potentially causing the system to read up to 16 KiB of unintended data from memory. This could lead to information disclosure or memory corruption within the kernel."], "name": "CVE-2026-64527", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2026-07-25T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-64527\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-64527\nhttps://lore.kernel.org/linux-cve-announce/2026072534-CVE-2026-64527-0c42@gregkh/T"], "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[76c56a5affeba1e163b66b9d8cc192e6154466f0,57d5d697642e05d5dd2d40660817765943dd709f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[76c56a5affeba1e163b66b9d8cc192e6154466f0,f5251226551bfec98c4705641b6f94ff1f238d91)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[76c56a5affeba1e163b66b9d8cc192e6154466f0,049a6b474823049fe60212f25f26e4b30f44ee8f)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[76c56a5affeba1e163b66b9d8cc192e6154466f0,588c84b461393ff1998ac7b97b04f953f642e0df)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[76c56a5affeba1e163b66b9d8cc192e6154466f0,164dc7bf17609340233c6bf4f66bb7c7008a0511)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[76c56a5affeba1e163b66b9d8cc192e6154466f0,c8974d96b6a5496f33dc69a3ce28a7bf5078def4)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "code_commit", "value": "[76c56a5affeba1e163b66b9d8cc192e6154466f0,7f87763f47a3c22fb50265a00619ef10f2394b18)"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "5.14"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[0,5.14)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[5.15.210,5.16.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.1.176,6.2.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.6.143,6.7.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.12.93,6.13.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[6.18.35,6.19.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "semver", "value": "[7.0.12,7.1.0)"}}, {"platform": null, "status": "unaffected", "versions": {"scheme": "generic", "value": "[7.1,*]"}}], "enrichment": {"confidence": 99.0, "confidence_source": "inferred", "scores": [{"score": 99.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Linux", "source": "cna", "vendor": "Linux"}, "product": "linux_kernel", "vendor": "linux"}], "created": "2026-07-25T23:45:03.752616+00:00", "updated": "2026-08-02T12:15:18.585535+00:00", "vendors": ["linux", "linux$PRODUCT$linux_kernel"]}