Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-64456

In the Linux kernel, the following vulnerability has been resolved: hwrng: virtio: clamp device-reported used.len at copy_data() random_recv_done() stores the device-reported used.len directly into vi->data_avail. copy_data() then indexes vi->data[] using vi->data_idx (advanced by previous copy_data() calls) and issues a memcpy() without re-validating either value against the posted buffer size sizeof(vi->data) (SMP_CACHE_BYTES bytes, typically 32 or 64). A malicious or buggy virtio-rng back
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:096fd7f902dd64b5fa39048893a9b3c0925645dce83f800973fb1df66fcc67b9
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/char/hw_random/virtio-rng.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"63335e7b638ae70028ae285bb95153874a8bc852","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"2e788948ff2a13358a303af112497a63201c5739","status":"affected","version":"f7f510ec19…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:86ea6c6d1ef71c609b6ac806666dc6f7d73f155c6051e25118f6937cb6d247aa · sha256:fafa771e6f207b3b… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/char/hw_random/virtio-rng.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.26"},{"lessThan":"2.6.26","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:86ea6c6d1ef71c609b6ac806666dc6f7d73f155c6051e25118f6937cb6d247aa · sha256:fafa771e6f207b3b… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/char/hw_random/virtio-rng.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"63335e7b638ae70028ae285bb95153874a8bc852","status":"affected","version":"f7f510ec195781c857ab76366a3e1c59e1caae42","versionType":"git"},{"lessThan":"2e788948ff2a13358a303af112497a63201c5739","status":"affected","version":"f7f510ec19…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:86ea6c6d1ef71c609b6ac806666dc6f7d73f155c6051e25118f6937cb6d247aa · sha256:fafa771e6f207b3b… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/char/hw_random/virtio-rng.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.26"},{"lessThan":"2.6.26","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.10.*","status":"unaffected","version":"5.10.261","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.212","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:86ea6c6d1ef71c609b6ac806666dc6f7d73f155c6051e25118f6937cb6d247aa · sha256:fafa771e6f207b3b… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion
{"metric":{"baseScore":7.7,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H","version":"3.1"},"metric_type":"cvssV3_1"}
  • cve_program_cvelist_v5cvss
    urn:baitaphish:normalized-source-record:v2:86ea6c6d1ef71c609b6ac806666dc6f7d73f155c6051e25118f6937cb6d247aa · sha256:fafa771e6f207b3b… · /containers/cna/metrics/0/cvssV3_1

Source references

8 source assertions
{"url":"https://git.kernel.org/stable/c/285e17c44e3873a73460f294acbd64018ff64385"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:86ea6c6d1ef71c609b6ac806666dc6f7d73f155c6051e25118f6937cb6d247aa · sha256:fafa771e6f207b3b… · /containers/cna/references/5
{"url":"https://git.kernel.org/stable/c/2e788948ff2a13358a303af112497a63201c5739"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:86ea6c6d1ef71c609b6ac806666dc6f7d73f155c6051e25118f6937cb6d247aa · sha256:fafa771e6f207b3b… · /containers/cna/references/2
{"url":"https://git.kernel.org/stable/c/3aa3e89cf80721c8d382b4c1a2b70a0449dad4a5"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:86ea6c6d1ef71c609b6ac806666dc6f7d73f155c6051e25118f6937cb6d247aa · sha256:fafa771e6f207b3b… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/63335e7b638ae70028ae285bb95153874a8bc852"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:86ea6c6d1ef71c609b6ac806666dc6f7d73f155c6051e25118f6937cb6d247aa · sha256:fafa771e6f207b3b… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/81dd21b5f0c299cc7b5bf84f04a61938559d20e6"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:86ea6c6d1ef71c609b6ac806666dc6f7d73f155c6051e25118f6937cb6d247aa · sha256:fafa771e6f207b3b… · /containers/cna/references/4
{"url":"https://git.kernel.org/stable/c/92d5736a62040ec1cfff23ea57e6599301690ad5"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:86ea6c6d1ef71c609b6ac806666dc6f7d73f155c6051e25118f6937cb6d247aa · sha256:fafa771e6f207b3b… · /containers/cna/references/6
{"url":"https://git.kernel.org/stable/c/e3046eeada299f917a8ad883af4434bfb86556b1"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:86ea6c6d1ef71c609b6ac806666dc6f7d73f155c6051e25118f6937cb6d247aa · sha256:fafa771e6f207b3b… · /containers/cna/references/7
{"url":"https://git.kernel.org/stable/c/fde19b0d4eeabae042519313c843fe6f27d41e9d"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:86ea6c6d1ef71c609b6ac806666dc6f7d73f155c6051e25118f6937cb6d247aa · sha256:fafa771e6f207b3b… · /containers/cna/references/3

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer