{
  "schema_version": "1.6.1",
  "id": "RPI-CVE-2026-64527",
  "modified": "2026-10-07T17:22:01Z",
  "upstream": [
    "CVE-2026-64527"
  ],
  "published": "2026-07-25T09:19:40Z",
  "summary": "drm/hyperv: validate VMBus packet size in receive callback",
  "details": "In the Linux kernel, the following vulnerability has been resolved:\n\ndrm/hyperv: validate VMBus packet size in receive callback\n\nhyperv_receive_sub() reads msg->vid_hdr.type and dispatches into one\nof four message-type branches without knowing how many bytes the host\nwrote into hv->recv_buf. The completion path then runs\nmemcpy(hv->init_buf, msg, VMBUS_MAX_PACKET_SIZE), so the consumer that\nwakes on wait_for_completion_timeout() can read up to 16 KiB of\nresidue from a prior message as if it were the response payload.\n\nPass bytes_recvd into hyperv_receive_sub() and reject any packet that\ndoes not cover the pipe + synthvid header. A single switch on\nmsg->vid_hdr.type then computes the type-specific payload size: the\nthree completion-driving types (SYNTHVID_VERSION_RESPONSE,\nSYNTHVID_RESOLUTION_RESPONSE, SYNTHVID_VRAM_LOCATION_ACK) fall through\nto a shared exit that requires that size before memcpy/complete, while\nSYNTHVID_FEATURE_CHANGE validates its own payload and returns before\nreading is_dirt_needed. Unknown types are dropped.\n\nSYNTHVID_RESOLUTION_RESPONSE is variable length: the host fills\nresolution_count entries, not the full SYNTHVID_MAX_RESOLUTION_COUNT\narray. Validate the fixed prefix first so resolution_count can be\nread, bound it against the array, then require only the count-sized\narray, so the shorter responses the host actually sends are accepted.\n\nOnly run the sub-handler when vmbus_recvpacket() returned success. The\nmemcpy length is bytes_recvd, which is bounded by VMBUS_MAX_PACKET_SIZE\nonly on a successful receive; on -ENOBUFS vmbus_recvpacket() instead\nreports the required length, which can exceed hv->recv_buf, so copying\nbytes_recvd would read and write past the 16 KiB buffers. Gating on the\nsuccess return keeps the copy bounded. The nonzero-return path is itself\na malformed-message case and is now logged rather than silently skipped;\nchannel recovery is not attempted.\n\nRejected packets are reported via drm_err_ratelimited() rather than\nsilently dropped, matching the CoCo-hardened pattern in\nhv_kvp_onchannelcallback().",
  "affected": [
    {
      "package": {
        "ecosystem": "Raspberry Pi OS:12",
        "name": "linux"
      },
      "versions": [
        "1:6.1.47-1+rpt4"
      ],
      "ecosystem_specific": {
        "binaries": [
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-2712",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v6",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v7l",
            "binary_version": "1:6.1.47-1+rpt4"
          },
          {
            "binary_name": "linux-image-6.1.0-rpi3-rpi-v8",
            "binary_version": "1:6.1.47-1+rpt4"
          }
        ]
      },
      "database_specific": {
        "per_version": {
          "1:6.1.47-1+rpt4": {
            "linux_commit": "655fc658a15ae7a6f37103754adb39ba52a9a14e",
            "upstream_version": "6.1.47",
            "assessment": "commit ancestry (strak rule)",
            "upstream_fixed": "6.1.176",
            "compiled_filter": false
          }
        }
      }
    }
  ],
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-64527"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/57d5d697642e05d5dd2d40660817765943dd709f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/f5251226551bfec98c4705641b6f94ff1f238d91"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/049a6b474823049fe60212f25f26e4b30f44ee8f"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/588c84b461393ff1998ac7b97b04f953f642e0df"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/164dc7bf17609340233c6bf4f66bb7c7008a0511"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/c8974d96b6a5496f33dc69a3ce28a7bf5078def4"
    },
    {
      "type": "FIX",
      "url": "https://git.kernel.org/stable/c/7f87763f47a3c22fb50265a00619ef10f2394b18"
    }
  ],
  "database_specific": {
    "source": "https://git.kernel.org/pub/scm/linux/security/vulns.git",
    "upstream_modified": "2026-07-25T09:19:40Z"
  }
}