CVE-2026-64550

In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: validate MAP frame length before ingress parsing

When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes

the skb straight to __rmnet_map_ingress_handler(), skipping the length

validation that rmnet_map_deaggregate() performs on the aggregated path.

The parser then dereferences the MAP header and csum header/trailer based on

the on-wire pkt_len without checking skb->len, so a short frame is read out

of bounds:

BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet

Read of size 1 at addr ffff88801118ed00 by task exploit/147

Call Trace:

...

rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)

__rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)

rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)

__netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)

netif_receive_skb (net/core/dev.c:6460)

tun_get_user (drivers/net/tun.c:1955)

tun_chr_write_iter (drivers/net/tun.c:2001)

vfs_write (fs/read_write.c:688)

ksys_write (fs/read_write.c:740)

do_syscall_64 (arch/x86/entry/syscall_64.c:94)

...

Factor that validation out of rmnet_map_deaggregate() into

rmnet_map_validate_packet_len() and run it on the no-aggregation path too.

The MAP header is bounds-checked first, since this path can receive a frame

shorter than the header.