CVE Explorer

CVE-2026-64527

In the Linux kernel, the following vulnerability has been resolved: drm/hyperv: validate VMBus packet size in receive callback hyperv_receive_sub() reads msg->vid_hdr.type and dispatches into one of four message-type branches without knowing how many bytes the host wrote into hv->recv_buf. The completion path then runs memcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that wakes on wait_for_completion_timeout() can read up to 16 KiB of residue from a prior message as if it were

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:4d55dbd70e79d090f4067d82ea02ddfeee96479dadbe7f86a97b49c2d65bbf52

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/gpu/drm/hyperv/hyperv_drm_proto.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"57d5d697642e05d5dd2d40660817765943dd709f","status":"affected","version":"76c56a5affeba1e163b66b9d8cc192e6154466f0","versionType":"git"},{"lessThan":"f5251226551bfec98c4705641b6f94ff1f238d91","status":"affected","version":"76c56a5affeba1e163b66b9d8cc192e6154466f0","versionType":"git"},{"lessThan":"049a6b474823049fe60212f25f26e4b30f44ee8f","status":"affected","version":"76c5…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:074fab98ad9b6c2e091dc93ea4b558ef46454e6f3b59ee33529f3ba985592923 · sha256:20ddd7ac7f82743b… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/gpu/drm/hyperv/hyperv_drm_proto.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"5.14"},{"lessThan":"5.14","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"5.15.*","status":"unaffected","version":"5.15.210","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.176","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.143","versionType":"…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:074fab98ad9b6c2e091dc93ea4b558ef46454e6f3b59ee33529f3ba985592923 · sha256:20ddd7ac7f82743b… · /containers/cna/affected/1

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:074fab98ad9b6c2e091dc93ea4b558ef46454e6f3b59ee33529f3ba985592923 · sha256:20ddd7ac7f82743b… · /containers/cna/affected/0

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:074fab98ad9b6c2e091dc93ea4b558ef46454e6f3b59ee33529f3ba985592923 · sha256:20ddd7ac7f82743b… · /containers/cna/affected/1

Source references

7 source assertions

{"url":"https://git.kernel.org/stable/c/049a6b474823049fe60212f25f26e4b30f44ee8f"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:074fab98ad9b6c2e091dc93ea4b558ef46454e6f3b59ee33529f3ba985592923 · sha256:20ddd7ac7f82743b… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/164dc7bf17609340233c6bf4f66bb7c7008a0511"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:074fab98ad9b6c2e091dc93ea4b558ef46454e6f3b59ee33529f3ba985592923 · sha256:20ddd7ac7f82743b… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/57d5d697642e05d5dd2d40660817765943dd709f"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:074fab98ad9b6c2e091dc93ea4b558ef46454e6f3b59ee33529f3ba985592923 · sha256:20ddd7ac7f82743b… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/588c84b461393ff1998ac7b97b04f953f642e0df"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:074fab98ad9b6c2e091dc93ea4b558ef46454e6f3b59ee33529f3ba985592923 · sha256:20ddd7ac7f82743b… · /containers/cna/references/3

{"url":"https://git.kernel.org/stable/c/7f87763f47a3c22fb50265a00619ef10f2394b18"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:074fab98ad9b6c2e091dc93ea4b558ef46454e6f3b59ee33529f3ba985592923 · sha256:20ddd7ac7f82743b… · /containers/cna/references/6

{"url":"https://git.kernel.org/stable/c/c8974d96b6a5496f33dc69a3ce28a7bf5078def4"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:074fab98ad9b6c2e091dc93ea4b558ef46454e6f3b59ee33529f3ba985592923 · sha256:20ddd7ac7f82743b… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/f5251226551bfec98c4705641b6f94ff1f238d91"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:074fab98ad9b6c2e091dc93ea4b558ef46454e6f3b59ee33529f3ba985592923 · sha256:20ddd7ac7f82743b… · /containers/cna/references/1

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer