CVE-2026-64449staging: vme_user: bound slave read/write to the kern_buf size
- 7.8HighCVSS base score
- 0.14%Exploitation in 30 daysEPSS · top 97% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without bounding *ppos + count against size_buf. vme_user_write()/vme_user_read() only clamp count to the VME window size (image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the user-supplied slave.size -- validated against the VME address space (up to VME_A32_MAX = 4 GiB), not against PCI_BUF_SIZE. When the window exceeds 128 KiB, a write()/read() copies past the kern_buf allocation. Clamp count against size_buf in both helpers, with an early return when *ppos is already at/after the buffer end. *ppos is >= 0 here (the caller rejects negative offsets), so size_buf - *ppos cannot wrap. This mirrors the existing clamp in the MASTER-path helpers resource_to_user() / resource_from_user(), and matches the read()/write() convention of a short transfer at end-of-buffer. Found by static analysis (CodeQL taint tracking + CBMC bounded model checking) and confirmed dynamically under KASAN with the vme_fake bridge: BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x2d/0x80 Write of size 262144 at addr ffff888004100000 by task trigger/68 _copy_from_user+0x2d/0x80 vme_user_write+0x13e/0x240 [vme_user] vfs_write+0x1b8/0x7a0 ksys_write+0xb8/0x150
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 23 days later
· 23 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| NVDNVD · Analyzed | 3.1 | High7.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.14% · top 97% of all CVEs (14 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.8.
Affected products
- affected f00a86d98a1ec3e99d352cda926fab767ba43b1f – < 65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed
- affected f00a86d98a1ec3e99d352cda926fab767ba43b1f – < adc8b9c30d716c362646edb45662aa1c641a154a
- affected f00a86d98a1ec3e99d352cda926fab767ba43b1f – < 8eff7cd4817e14dbe3b9952cce55ef52d1d38940
- affected f00a86d98a1ec3e99d352cda926fab767ba43b1f – < e99f2df433c63c86c93de1e5f08f16e404388756
- affected f00a86d98a1ec3e99d352cda926fab767ba43b1f – < 1b495fa0d4927c88d88bf346bf311f2e26e860ed
- affected f00a86d98a1ec3e99d352cda926fab767ba43b1f – < 9f32f38265014fac7f5dc9490fb01a638ce6e121
- affected 2.6.32
- unaffected < 2.6.32
- unaffected 6.1.178 – ≤ 6.1.*
- unaffected 6.6.145 – ≤ 6.6.*
- unaffected 6.12.96 – ≤ 6.12.*
- unaffected 6.18.39 – ≤ 6.18.*
- unaffected 7.1.4 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References6
- https://git.kernel.org/stable/c/65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed (opens in a new tab)
- https://git.kernel.org/stable/c/adc8b9c30d716c362646edb45662aa1c641a154a (opens in a new tab)
- https://git.kernel.org/stable/c/8eff7cd4817e14dbe3b9952cce55ef52d1d38940 (opens in a new tab)
- https://git.kernel.org/stable/c/e99f2df433c63c86c93de1e5f08f16e404388756 (opens in a new tab)
- https://git.kernel.org/stable/c/1b495fa0d4927c88d88bf346bf311f2e26e860ed (opens in a new tab)
- https://git.kernel.org/stable/c/9f32f38265014fac7f5dc9490fb01a638ce6e121 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-48793 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-64449)Record last updated .