CVE-2026-64449VulnerabilityPublished 07/25/2026

In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path… (CVE-2026-64449)

Source GCVE Database

Severity

High

No CVSS score published yet

Exploitation: Not in CISA KEV, no exploitation reported
EPSS: 0.1% chance of exploitation in 30 days – higher than 2% of CVEs

What to do

AI-suggested

A fix has been implemented in the Linux kernel to clamp the read/write count against the fixed kernel buffer size and prevent out-of-bounds accesses. Users should update to a Linux kernel version that includes this fix. Since this is not a cloud service, remediation depends on applying the official kernel patch. Patch status is not explicitly confirmed in the provided data; users should consult the official Linux kernel advisories or source repositories for the exact fixed versions and apply updates accordingly.

Description

In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without bounding *ppos + count against size_buf. vme_user_write()/vme_user_read() only clamp count to the VME window size (image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the user-supplied slave.size -- validated against the VME address space (up to VME_A32_MAX = 4 GiB), not against PCI_BUF_SIZE. When the window exceeds 128 KiB, a write()/read() copies past the kern_buf allocation. Clamp count against size_buf in both helpers, with an early return when *ppos is already at/after the buffer end. *ppos is >= 0 here (the caller rejects negative offsets), so size_buf - *ppos cannot wrap. This mirrors the existing clamp in the MASTER-path helpers resource_to_user() / resource_from_user(), and matches the read()/write() convention of a short transfer at end-of-buffer. Found by static analysis (CodeQL taint tracking + CBMC bounded model checking) and confirmed dynamically under KASAN with the vme_fake bridge: BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x2d/0x80 Write of size 262144 at addr ffff888004100000 by task trigger/68 _copy_from_user+0x2d/0x80 vme_user_write+0x13e/0x240 [vme_user] vfs_write+0x1b8/0x7a0 ksys_write+0xb8/0x150

Summary

The Linux kernel's vme_user driver had a vulnerability where the SLAVE-path helpers buffer_to_user() and buffer_from_user() copied 'count' bytes into or out of a fixed-size kernel buffer (128 KiB) without properly bounding the sum of the offset (*ppos) and count against the buffer size. The user-supplied slave window size could exceed this buffer size, allowing read/write operations to overflow the kernel buffer. This was fixed by adding clamping logic to ensure that the count does not exceed the kernel buffer size and that operations do not proceed if the offset is beyond the buffer end. The issue was found through static analysis tools (CodeQL and CBMC) and confirmed with Kernel Address Sanitizer (KASAN) testing, which detected slab-out-of-bounds writes during vme_user_write().

Impact

This vulnerability could cause out-of-bounds memory accesses in kernel space, potentially leading to memory corruption, system instability, or crashes. No known exploits in the wild have been reported. The impact is limited to systems using the vulnerable vme_user staging driver with user-configured slave window sizes exceeding the kernel buffer size.

What to do

Description

AnalysisAI-generated, updated 07/25/2026, 23:20:09 UTC

Technical details

References

Related threats