CVE-2026-64318

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in Linux Kernel AIX Partition Handling

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the pp_count scan to the ppe array aix_partition() reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array: int numpps = be16_to_cpu(pvd->pp_count); ... for (i = 0; i < numpps; i += 1) { struct ppe *p = pvd->ppe + i; ... lp_ix = be16_to_cpu(p->lp_ix); pvd points at a single kmalloc()'d struct pvd whose ppe[] member holds a fixed ARRAY_SIZE(pvd->ppe) (1016) entries, but the loop runs up to the on-disk pp_count. pp_count is an unvalidated __be16 read straight from the descriptor, so a crafted AIX image with pp_count larger than 1016 drives the loop to read pvd->ppe[i] past the end of the allocation (up to 65535 entries, ~2 MB out of bounds). The partition scan runs without mounting anything, when a block device with a crafted AIX/IBM partition table appears (an attacker-supplied image attached with losetup -P, or a device auto-scanned by udev), via msdos_partition() -> aix_partition(). Clamp the scan to the number of entries the ppe[] array can hold.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64318

EUVD

EUVD-2026-49030

Affected Vendors & Products

Vendor	Product	Version / Range
ibm	aix	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves a buffer overflow in the AIX partition parsing code. The issue occurs when the kernel reads a physical volume descriptor from a disk and scans its physical-partition-extent array. The scan uses an unvalidated value from the disk to determine how many entries to read, which can exceed the allocated buffer size. This leads to out-of-bounds memory access, potentially causing crashes or arbitrary code execution.

Detection Guidance

This vulnerability is triggered by a crafted AIX partition table with a pp_count value exceeding 1016. Detection requires checking for malformed partition tables on block devices. Use commands like 'sudo fdisk -l' to inspect partition tables or 'sudo losetup -a' to check loop devices for suspicious images. Monitor kernel logs for out-of-bounds access errors.

Impact Analysis

If exploited, this vulnerability could allow an attacker to crash the system or execute arbitrary code with kernel privileges. This might lead to denial-of-service conditions or compromise of the entire system. The attack requires an attacker-supplied disk image with a crafted AIX partition table, which could be attached via losetup or auto-scanned by udev.

Compliance Impact

This vulnerability involves an out-of-bounds read in the Linux kernel's AIX partition parsing, which could lead to memory corruption or crashes when processing crafted partition tables. While it does not directly impact data privacy or security controls, such kernel vulnerabilities may affect compliance by introducing instability or potential unauthorized access vectors in systems handling sensitive data under GDPR or HIPAA.

Mitigation Strategies

Apply the Linux kernel patch that clamps the pp_count scan to the ppe array size. Avoid mounting or attaching untrusted disk images with AIX partition tables. Update udev rules to prevent auto-scanning of suspicious devices. Monitor vendor advisories for kernel updates.

Hi! I’m here to help you understand CVE-2026-64318. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70