CVE-2026-64550

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerability is reached by `write()` to a tun fd owned by the attacker, exactly as in the reporter's KASAN trace (`tun_chr_write_iter` → `netif_receive_skb` → `rmnet_rx_handler`), requiring a local account. Although rmnet can be stacked on an Ethernet device (commit 74692caf1b0b), the universally available and demonstrated vector is local.

AC:LAttack complexity, low

Every precondition is attacker-chosen — the `data_format` flags (deaggregation off, CKSUMV4 on) via `IFLA_RMNET_FLAGS`, the frame length, and the `pkt_len`/`pad` fields that select the OOB offset — with no race, timing, or uncontrolled memory-layout dependency. The trigger is a single deterministic `write()` that can be repeated indefinitely to sweep offsets.

PR:LPrivileges required, low

Only an unprivileged local account is needed: `/dev/net/tun` is world-accessible, and both `TUNSETIFF` and `rtnl_newlink` gate on namespace-scoped `ns_capable`/`netlink_net_capable(CAP_NET_ADMIN)`, which `unshare -Urn` grants without real root.

UI:NUser interaction, none

The attacker creates the tun device, the rmnet link, and writes the malformed frame entirely on its own. No victim action or pre-existing configuration is required.

S:UScope, unchanged

The out-of-bounds access and its consequences are confined to kernel memory within the same security authority. No VM, IOMMU, or sandbox boundary is crossed.

C:HConfidentiality impact, high

This is an attacker-positioned read up to 65535 bytes past a small slab object, and the result is disclosed back to userspace through the unprivileged rmnet ethtool counters — because the pseudo-header checksum is computed from the attacker's own IP header, the exact 16-bit heap word at a chosen offset is recoverable in a few probes, yielding a precise heap-read primitive for KASLR bypass and secret disclosure.

I:LIntegrity impact, low

There is no arbitrary write, but out-of-bounds data determines `skb->ip_summed = CHECKSUM_UNNECESSARY`, causing packets whose checksums were never validated to be accepted by the IP stack as verified. On the MAP-command path `rmnet_map_send_ack()` also writes `cmd->cmd_type` past the end of a short frame after `skb_trim()` underflows into a no-op.

A:HAvailability impact, high

A 64 KB overshoot from a small kmalloc object can land on an unmapped page (guard pages, DEBUG_PAGEALLOC/hardened allocators, memory-region edges), faulting in kernel context and producing an oops; on the real WWAN receive path (ipa/qmi_wwan/mhi_net NAPI) this executes in softirq, where the fault is a panic. KASAN builds abort immediately, as the reporter's trace shows.