In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the pp_count scan to the ppe array aix_partition() reads… (CVE-2026-64318)
Source GCVE Database
Not known to be exploited : update affected systems when convenient.
Data as of 10/24/2026, 17:08:26 UTC
No CVSS score from NVD or the CNA
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
What to do
AI-suggested
A fix has been implemented in the Linux kernel to clamp the pp_count scan to the size of the allocated ppe array, preventing out-of-bounds reads. Users should apply the official kernel updates that include this patch once available. Since this is a kernel-level vulnerability, updating to a patched kernel version is the recommended remediation.
Description
In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the pp_count scan to the ppe array aix_partition() reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array: int numpps = be16_to_cpu(pvd->pp_count); ... for (i = 0; i < numpps; i += 1) { struct ppe *p = pvd->ppe + i; ... lp_ix = be16_to_cpu(p->lp_ix); pvd points at a single kmalloc()'d struct pvd whose ppe[] member holds a fixed ARRAY_SIZE(pvd->ppe) (1016) entries, but the loop runs up to the on-disk pp_count. pp_count is an unvalidated __be16 read straight from the descriptor, so a crafted AIX image with pp_count larger than 1016 drives the loop to read pvd->ppe[i] past the end of the allocation (up to 65535 entries, ~2 MB out of bounds). The partition scan runs without mounting anything, when a block device with a crafted AIX/IBM partition table appears (an attacker-supplied image attached with losetup -P, or a device auto-scanned by udev), via msdos_partition() -> aix_partition(). Clamp the scan to the number of entries the ppe[] array can hold.
Impact
An attacker can supply a crafted AIX partition table image that causes the kernel to read memory beyond the allocated bounds of the ppe array during partition scanning. This out-of-bounds read could potentially lead to information disclosure or kernel memory corruption. The vulnerability is triggered without mounting the filesystem, during device detection or setup. No known exploits in the wild have been reported.
Summary
The Linux kernel's aix_partition() function reads the physical volume descriptor (pvd) into a fixed-size struct containing a physical-partition-extent (ppe) array of 1016 entries. However, it uses an unvalidated pp_count field from the on-disk descriptor to iterate over the ppe array, which can be up to 65535, leading to out-of-bounds reads beyond the allocated array. This vulnerability can be triggered when a crafted AIX partition table is detected by the kernel, such as when attaching a malicious image via losetup or during automatic scanning by udev. The fix bounds the scan loop to the actual size of the ppe array to prevent out-of-bounds access.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64318 (opens in a new tab)
- git.kernel.org/stable/c/09861651617ba0fec089e8b9477439e68398c110 (opens in a new tab)
- git.kernel.org/stable/c/2dc0bfd2fe355fb930de63c2f2eb8ced8570c579 (opens in a new tab)
- git.kernel.org/stable/c/44f37ee92fdcd377c41bdf6a31cdd8cc7d4c410e (opens in a new tab)
- git.kernel.org/stable/c/4671bb74bba05fdd4acf670a35758c29e8c97b83 (opens in a new tab)
- git.kernel.org/stable/c/5eacdb1967378f5e5591cd27a2d8cdee2df1a599 (opens in a new tab)
- git.kernel.org/stable/c/b5e9c09309e18fd9839ad007c238120353ca0cc4 (opens in a new tab)
- git.kernel.org/stable/c/ce93228e2193a17d2c58b656e439bb39fe5c3af8 (opens in a new tab)
- git.kernel.org/stable/c/fd94a779020f2ecc8b2607f4c20b34acb1763b9a (opens in a new tab)