PT-2026-64539 · Linux · Linux
CVE-2026-64318
·
Publicado
2026-07-25
·
Atualizado
2026-07-25
Nenhuma
Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
partitions: aix: bound the pp count scan to the ppe array
aix partition() reads the physical volume descriptor into a fixed-size
struct pvd and then scans its physical-partition-extent array:
int numpps = be16 to cpu(pvd->pp count);
...
for (i = 0; i < numpps; i += 1) {
struct ppe *p = pvd->ppe + i;
...
lp ix = be16 to cpu(p->lp ix);pvd points at a single kmalloc()'d struct pvd whose ppe[] member holds a
fixed ARRAY SIZE(pvd->ppe) (1016) entries, but the loop runs up to the
on-disk pp count. pp count is an unvalidated be16 read straight from
the descriptor, so a crafted AIX image with pp count larger than 1016
drives the loop to read pvd->ppe[i] past the end of the allocation (up
to 65535 entries, ~2 MB out of bounds).
The partition scan runs without mounting anything, when a block device
with a crafted AIX/IBM partition table appears (an attacker-supplied
image attached with losetup -P, or a device auto-scanned by udev), via
msdos partition() -> aix partition().
Clamp the scan to the number of entries the ppe[] array can hold.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Identificadores relacionados
Produtos afetados
Linux