The Linux kernel's vme_user driver had a vulnerability where the SLAVE-path helpers buffer_to_user() and buffer_from_user() copied 'count' bytes into or out of a fixed-size kernel buffer (128 KiB) without properly bounding the sum of the offset (*ppos) and count against the buffer size. The user-supplied slave window size could exceed this buffer size, allowing read/write operations to overflow the kernel buffer. This was fixed by adding clamping logic to ensure that the count does not exceed the kernel buffer size and that operations do not proceed if the offset is beyond the buffer end. The issue was found through static analysis tools (CodeQL and CBMC) and confirmed with Kernel Address Sanitizer (KASAN) testing, which detected slab-out-of-bounds writes during vme_user_write().

This vulnerability could cause out-of-bounds memory accesses in kernel space, potentially leading to memory corruption, system instability, or crashes. No known exploits in the wild have been reported. The impact is limited to systems using the vulnerable vme_user staging driver with user-configured slave window sizes exceeding the kernel buffer size.

A fix has been implemented in the Linux kernel to clamp the read/write count against the fixed kernel buffer size and prevent out-of-bounds accesses. Users should update to a Linux kernel version that includes this fix. Since this is not a cloud service, remediation depends on applying the official kernel patch. Patch status is not explicitly confirmed in the provided data; users should consult the official Linux kernel advisories or source repositories for the exact fixed versions and apply updates accordingly.