Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-53199— hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf

Quick assessment

Affected
Linux Linux
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于netvsc_copy_to_send_buf()函数使用了phys_to_virt()，导致在32位x86系统上启用CONFIG_HIGHMEM时，页面地址映射错误，可能在传输软中断路径上引发致命故障。

CVSS 7.5 · High EPSS 0.50% · P42

Possible ATT&CK Techniques 1 AI

T1059 · Command and Scripting Interpreter

Affected Version Matrix 18

VendorProduct Version RangeStatus
Linux Linux c25aaf814a63f9d9c4e45416f13d70ef0aa0be2e< 16514afeb7d3d121072ba9a0b640d6c1c5507db0 affected
c25aaf814a63f9d9c4e45416f13d70ef0aa0be2e< a82d4251918f37d9c5aab7b365157669fb885ec3 affected
c25aaf814a63f9d9c4e45416f13d70ef0aa0be2e< 695c59cf7bf707e6ff8cea01916ee50e86616933 affected
c25aaf814a63f9d9c4e45416f13d70ef0aa0be2e< 09b8a7aa5a341bb345dc492aac139525efa13515 affected
c25aaf814a63f9d9c4e45416f13d70ef0aa0be2e< 918c0c988239aa5ab96b254e504d191af6191061 affected
c25aaf814a63f9d9c4e45416f13d70ef0aa0be2e< 0b38870d81ab3a04c1ab0598d9d3285f5d9d0584 affected
c25aaf814a63f9d9c4e45416f13d70ef0aa0be2e< fe7221b4346418d27ec2daccfc09df6692b76f0b affected
c25aaf814a63f9d9c4e45416f13d70ef0aa0be2e< 004e9ecfe6c5384f9e0b2f6f6389d42ec22789af affected
… +10 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-53199

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf
Source: CVE Program / CVE List V5
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: hv_netvsc: use kmap_local_page in netvsc_copy_to_send_buf netvsc_copy_to_send_buf() copies page buffer entries into the VMBus send buffer using phys_to_virt() on the entry PFN. Entries for the RNDIS header and the skb linear data come from kmalloc'd memory and are always in the kernel direct map, but entries for skb fragments reference page cache or user pages, which on 32-bit x86 with CONFIG_HIGHMEM=y can live above the LOWMEM boundary. For such a page phys_to_virt() returns an address outside the direct map and the subsequent memcpy() faults on the transmit softirq path, which is fatal. Map the pages with kmap_local_page() instead, handling two properties of the page buffer entries: - pb[i].pfn is a Hyper-V PFN at HV_HYP_PAGE_SIZE (4K) granularity, not a native PFN. Reconstruct the physical address first and derive the native page from it, so the mapping stays correct where PAGE_SIZE > HV_HYP_PAGE_SIZE (e.g. arm64 with 64K pages). - Since commit 41a6328b2c55 ("hv_netvsc: Preserve contiguous PFN grouping in the page buffer array"), an entry describes a full physically contiguous fragment and pb[i].len can exceed PAGE_SIZE, while kmap_local_page() maps a single page. Copy page by page, splitting at native page boundaries. The copy path only handles packets smaller than the send section size (6144 bytes by default); larger packets take the cp_partial path where only the RNDIS header is copied. So entries here are bounded by the section size and a copy is split at most once on 4K-page systems. On !CONFIG_HIGHMEM configs kmap_local_page() folds to page_address() and no mapping work is added.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Source: CVE Program / CVE List V5
Vulnerability Type
N/A
Source: CVE Program / CVE List V5
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会开源的操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于netvsc_copy_to_send_buf()函数使用了phys_to_virt()，导致在32位x86系统上启用CONFIG_HIGHMEM时，页面地址映射错误，可能在传输软中断路径上引发致命故障。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
Linux Linux c25aaf814a63f9d9c4e45416f13d70ef0aa0be2e ~ 16514afeb7d3d121072ba9a0b640d6c1c5507db0 -
Linux Linux 3.16 -

II. Public POCs for CVE-2026-53199

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-53199

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-53199 (8)

Same Patch Batch · Linux · 2026-06-25 · 146 CVEs total

CVE-2026-53228 9.8 CRITICAL ipv6: sit: reload inner IPv6 header after GSO offloads
CVE-2026-53247 9.8 CRITICAL net: ethernet: mtk_eth_soc: Fix use-after-free in metadata dst teardown
CVE-2026-53246 9.8 CRITICAL sctp: validate cached peer INIT chunk length in COOKIE_ECHO processing
CVE-2026-53151 9.8 CRITICAL rxrpc: Fix the ACK parser to extract the SACK table for parsing
CVE-2026-53260 9.8 CRITICAL tcp: Add preempt_{disable,enable}_nested() in reqsk_queue_hash_req().
CVE-2026-53175 9.8 CRITICAL inet: frags: fix use-after-free caused by the fqdir_pre_exit() flush
CVE-2026-53176 9.8 CRITICAL IB/isert: Reject login PDUs shorter than ISER_HEADERS_LEN
CVE-2026-53221 9.8 CRITICAL ip6_vti: fix incorrect tunnel matching in vti6_tnl_lookup()
CVE-2026-53215 9.8 CRITICAL net: mvpp2: refill RX buffers before XDP or skb use
CVE-2026-53216 9.8 CRITICAL net: mvpp2: limit XDP frame size to the RX buffer
CVE-2026-53131 9.4 CRITICAL netfilter: require Ethernet MAC header before using eth_hdr()
CVE-2026-53225 9.1 CRITICAL sctp: fix uninit-value in __sctp_rcv_asconf_lookup()
CVE-2026-53186 9.1 CRITICAL RDMA/srp: bound SRP_RSP sense copy by the received length
CVE-2026-53224 9.1 CRITICAL sctp: validate embedded INIT chunk and address list lengths in cookie
CVE-2026-53200 8.8 HIGH KVM: arm64: nv: Fix handling of XN[0] when !FEAT_XNX
CVE-2026-53248 8.8 HIGH net: airoha: Fix use-after-free in metadata dst teardown
CVE-2026-53159 8.8 HIGH misc: fastrpc: fix DMA address corruption due to find_vma misuse
CVE-2026-53198 8.8 HIGH ksmbd: fix use-after-free of a deferred file_lock on double SMB2_CANCEL
CVE-2026-53188 8.8 HIGH RDMA/core: Validate the passed in fops for ib_get_ucaps()
CVE-2026-53232 8.8 HIGH net: phy: clean the sfp upstream if phy probing fails

Showing top 20 of 146 CVEs. View all on vendor page &rarr; →

IV. Related Vulnerabilities

Same product: Linux
Same vendor: Linux

V. Comments for CVE-2026-53199

No comments yet

Leave a comment