Executive brief
A vulnerability in the Linux kernel's Hyper-V network driver could cause a system crash (kernel panic). This occurs when the system attempts to process network data stored in specific memory areas that are not directly accessible, leading to a fatal error. This issue primarily affects 32-bit systems or specific high-memory configurations running as Hyper-V guests.
Technical details
A flaw exists in the hv_netvsc driver's netvsc_copy_to_send_buf() function where it uses phys_to_virt() to access page buffer entries. On 32-bit x86 systems with CONFIG_HIGHMEM enabled, skb fragments may reside in high memory above the LOWMEM boundary. Using phys_to_virt() on these addresses returns invalid pointers outside the kernel direct map, causing a fatal page fault during memcpy() in the transmit softirq path. The fix replaces phys_to_virt() with kmap_local_page() to safely map high-memory pages before copying.
Affected products
- Linux Linux Kernel versions including c25aaf814a63 and prior to 004e9ecfe6c5
Timeline
- 2026-06-04: patched: Initial fix authored by Anton Leontev
- 2026-06-25: disclosed: CVE-2026-53199 published
References
- https://git.kernel.org/stable/c/004e9ecfe6c5384f9e0b2f6f6389d42ec22789af
- https://git.kernel.org/stable/c/09b8a7aa5a341bb345dc492aac139525efa13515
- https://git.kernel.org/stable/c/0b38870d81ab3a04c1ab0598d9d3285f5d9d0584
- https://git.kernel.org/stable/c/16514afeb7d3d121072ba9a0b640d6c1c5507db0
- https://git.kernel.org/stable/c/695c59cf7bf707e6ff8cea01916ee50e86616933
- https://git.kernel.org/stable/c/918c0c988239aa5ab96b254e504d191af6191061
- https://git.kernel.org/stable/c/a82d4251918f37d9c5aab7b365157669fb885ec3