EUVD-2026-49603

In the Linux kernel, the following vulnerability has been resolved: virtio-net: fix len check in receivebig receivebig bounds the device-announced length by bigpacketsnumskbfrags + 1 PAGESIZE. That is still too loose: addrecvbufbig sets sg1 to start at offset sizeofstruct paddedvnethdr into the...

CVE-2026-64552

The CVE is for Linux kernel virtio-net: receive_big() len check. The vulnerability arises because device-announced length is bounded by (big_packets_num_skbfrags + 1) * PAGE_SIZE, but add_recvbuf_big() places the header at an offset in the first page, creating a gap where a malicious virtio backe...