CVE-2026-64550: net: qualcomm: rmnet: validate MAP frame length before ingress parsing

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

net: qualcomm: rmnet: validate MAP frame length before ingress parsing

When ingress deaggregation is disabled, rmnet_map_ingress_handler() passes
the skb straight to __rmnet_map_ingress_handler(), skipping the length
validation that rmnet_map_deaggregate() performs on the aggregated path.
The parser then dereferences the MAP header and csum header/trailer based on
the on-wire pkt_len without checking skb->len, so a short frame is read out
of bounds:

  BUG: KASAN: slab-out-of-bounds in rmnet_map_checksum_downlink_packet
  Read of size 1 at addr ffff88801118ed00 by task exploit/147
  Call Trace:
   ...
   rmnet_map_checksum_downlink_packet (drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c:413)
   __rmnet_map_ingress_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:96)
   rmnet_rx_handler (drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c:129)
   __netif_receive_skb_core.constprop.0 (net/core/dev.c:6089)
   netif_receive_skb (net/core/dev.c:6460)
   tun_get_user (drivers/net/tun.c:1955)
   tun_chr_write_iter (drivers/net/tun.c:2001)
   vfs_write (fs/read_write.c:688)
   ksys_write (fs/read_write.c:740)
   do_syscall_64 (arch/x86/entry/syscall_64.c:94)
   ...

Factor that validation out of rmnet_map_deaggregate() into
rmnet_map_validate_packet_len() and run it on the no-aggregation path too.
The MAP header is bounds-checked first, since this path can receive a frame
shorter than the header.

The Linux kernel CVE team has assigned CVE-2026-64550 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 4.14 with commit ceed73a2cf4aff2921802aa3d21d45280677547d and fixed in 5.10.261 with commit ed25befc8c36f896b5878f9078faddb67fd7e2d0
	Issue introduced in 4.14 with commit ceed73a2cf4aff2921802aa3d21d45280677547d and fixed in 5.15.212 with commit a54d76d176e50d2fdbd39b7231efe256170339e4
	Issue introduced in 4.14 with commit ceed73a2cf4aff2921802aa3d21d45280677547d and fixed in 6.1.178 with commit 00f4c366dbca16a40772c3b7ec2d8cba839e9724
	Issue introduced in 4.14 with commit ceed73a2cf4aff2921802aa3d21d45280677547d and fixed in 6.6.145 with commit 3868c3244369ab709a90c9aad7534d406009b824
	Issue introduced in 4.14 with commit ceed73a2cf4aff2921802aa3d21d45280677547d and fixed in 6.12.97 with commit 14eb0c9491385d5361a292ea4974aec0e6887299
	Issue introduced in 4.14 with commit ceed73a2cf4aff2921802aa3d21d45280677547d and fixed in 6.18.40 with commit 1b12612c367e4be9b0814c0468e7e687835315b4
	Issue introduced in 4.14 with commit ceed73a2cf4aff2921802aa3d21d45280677547d and fixed in 7.1.5 with commit 231a8a4b76cb1b1827b3b19d7b3603642f5aaaef
	Issue introduced in 4.14 with commit ceed73a2cf4aff2921802aa3d21d45280677547d and fixed in 7.2-rc3 with commit f0f1887a9e30712a1df03e152dce6fb91344b1f3

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64550
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/net/ethernet/qualcomm/rmnet/rmnet_handlers.c
	drivers/net/ethernet/qualcomm/rmnet/rmnet_map.h
	drivers/net/ethernet/qualcomm/rmnet/rmnet_map_data.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/ed25befc8c36f896b5878f9078faddb67fd7e2d0
	https://git.kernel.org/stable/c/a54d76d176e50d2fdbd39b7231efe256170339e4
	https://git.kernel.org/stable/c/00f4c366dbca16a40772c3b7ec2d8cba839e9724
	https://git.kernel.org/stable/c/3868c3244369ab709a90c9aad7534d406009b824
	https://git.kernel.org/stable/c/14eb0c9491385d5361a292ea4974aec0e6887299
	https://git.kernel.org/stable/c/1b12612c367e4be9b0814c0468e7e687835315b4
	https://git.kernel.org/stable/c/231a8a4b76cb1b1827b3b19d7b3603642f5aaaef
	https://git.kernel.org/stable/c/f0f1887a9e30712a1df03e152dce6fb91344b1f3