PT-2026-64623 · Linux · Linux

CVE-2026-64402

·

Publicado

2026-07-25

·

Atualizado

2026-07-25

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
coresight: ultrasoc-smb: Fix OOB write in smb sync perf buffer()
When the SMB sink is used as a perf AUX sink, smb update buffer() calls smb sync perf buffer() to copy hardware trace data into the perf AUX ring buffer pages. It derives pg idx = head >> PAGE SHIFT from @head, which is handle->head, and indexes dst pages[pg idx]. The pg idx %= nr pages normalization is only applied after the first loop iteration.
This leaves the initial page index underived from the buffer size, which can result in an out-of-bounds write past dst pages[] when head exceeds the AUX buffer size.
Normalize head modulo the AUX buffer size before deriving the page index and offset, mirroring tmc etr sync perf buffer().
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64402

Produtos afetados

Linux