PT-2026-64670 · Linux · Linux
CVE-2026-64449
·
Published
2026-07-25
·
Updated
2026-07-25
None
No severity ratings or metrics are available. When they are, we'll update the corresponding info on the page.
In the Linux kernel, the following vulnerability has been resolved:
staging: vme user: bound slave read/write to the kern buf size
The SLAVE-path helpers buffer to user() and buffer from user() copy
'count' bytes into/out of the fixed-size kern buf (size buf ==
PCI BUF SIZE == 0x20000, 128 KiB) using *ppos as the offset, without
bounding *ppos + count against size buf.
vme user write()/vme user read() only clamp count to the VME window size
(image size = vme get size(resource)), which VME SET SLAVE sets from the
user-supplied slave.size -- validated against the VME address space (up
to VME A32 MAX = 4 GiB), not against PCI BUF SIZE. When the window
exceeds 128 KiB, a write()/read() copies past the kern buf allocation.
Clamp count against size buf in both helpers, with an early return when
*ppos is already at/after the buffer end. *ppos is >= 0 here (the caller
rejects negative offsets), so size buf - *ppos cannot wrap. This mirrors
the existing clamp in the MASTER-path helpers resource to user() /
resource from user(), and matches the read()/write() convention of a
short transfer at end-of-buffer.
Found by static analysis (CodeQL taint tracking + CBMC bounded model
checking) and confirmed dynamically under KASAN with the vme fake bridge:
BUG: KASAN: slab-out-of-bounds in copy from user+0x2d/0x80
Write of size 262144 at addr ffff888004100000 by task trigger/68
copy from user+0x2d/0x80
vme user write+0x13e/0x240 [vme user]
vfs write+0x1b8/0x7a0
ksys write+0xb8/0x150
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linux