# CVE-2026-64550: linux: In the Linux kernel, the following vulnerability has been resolved:  net: qualcomm: rmnet: validate MAP frame length...

CVE-2026-64550 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-64550, released August 1, 2026. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2026-64550
- Priority: High
- CVSS: 7.3 (high)
- EPSS: 0.0013
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Jul 27, 2026

## Description

In the Linux kernel, the following vulnerability has been resolved:  net: qualcomm: rmnet: validate MAP frame length before ingress parsing  When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes the skb straight to __rmnet_map_ingress_handler(), skipping the length validation that rmnet_map_deaggregate() performs on the aggregated path. The parser then dereferences the MAP header and csum header/trailer based on the on-wire pkt_len without checking skb->len, so a short frame is read out of bounds:    BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet   Read of size 1 at addr ffff88801118ed00 by task exploit/147   Call Trace:    ...    rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)    __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)    rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)    __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)    netif_receive_skb (net/core/dev.c:6460)    tun_get_user (drivers/net/tun.c:1955)    tun_chr_write_iter (drivers/net/tun.c:2001)    vfs_write (fs/read_write.c:688)    ksys_write (fs/read_write.c:740)    do_syscall_64 (arch/x86/entry/syscall_64.c:94)    ...  Factor that validation out of rmnet_map_deaggregate() into rmnet_map_validate_packet_len() and run it on the no-aggregation path too. The MAP header is bounds-checked first, since this path can receive a frame shorter than the header.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | linux Debian 12.15 (bookworm) | 6.1.180-1 | [DEBIAN-CVE-2026-64550](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64550.md) | Aug 1, 2026 |
| Linux | linux Debian 13.5 (trixie) | 6.12.100-1 | [DEBIAN-CVE-2026-64550](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64550.md) | Aug 1, 2026 |
| Linux | linux Debian 14 | 7.1.5-1 | [DEBIAN-CVE-2026-64550](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64550.md) | Aug 1, 2026 |
| Linux | linux-6.12 Debian 12.15 (bookworm) | 6.12.100-1~deb12u1 | [DEBIAN-CVE-2026-64550](https://patchblox.com/security/data/fix/linux/debian-cve-2026-64550.md) | Aug 1, 2026 |

---

Data as of 2026-11-08T13:06:02Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.