CVE-2026-64402

Awaiting Analysis Awaiting Analysis - Queue

Out-of-Bounds Write in Linux Kernel Coresight Ultrasoc-smb

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() When the SMB sink is used as a perf AUX sink, smb_update_buffer() calls smb_sync_perf_buffer() to copy hardware trace data into the perf AUX ring buffer pages. It derives pg_idx = head >> PAGE_SHIFT from @head, which is handle->head, and indexes dst_pages[pg_idx]. The pg_idx %= nr_pages normalization is only applied after the first loop iteration. This leaves the initial page index underived from the buffer size, which can result in an out-of-bounds write past dst_pages[] when head exceeds the AUX buffer size. Normalize head modulo the AUX buffer size before deriving the page index and offset, mirroring tmc_etr_sync_perf_buffer().

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64402

EUVD

EUVD-2026-48946

Affected Vendors & Products

Vendor	Product	Version / Range
coresight	ultrasoc-smb	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where an out-of-bounds write can occur in the coresight ultrasoc-smb driver. When using the SMB sink as a perf AUX sink, the function smb_sync_perf_buffer() incorrectly calculates the page index for copying hardware trace data. This leads to writing past the allocated buffer pages if the head value exceeds the AUX buffer size.

Detection Guidance

This vulnerability is specific to the Linux kernel's coresight ultrasoc-smb component and requires kernel-level access to detect. Check if your system uses the affected component with commands like 'lsmod | grep ultrasoc' or 'dmesg | grep -i ultrasoc'. Monitor kernel logs for OOB write errors or crashes related to perf AUX sinks.

Impact Analysis

This vulnerability could allow an attacker with local access to cause memory corruption, potentially leading to system crashes, privilege escalation, or arbitrary code execution. It may also enable denial-of-service conditions on affected systems.

Compliance Impact

This vulnerability involves an out-of-bounds write in the Linux kernel's coresight subsystem, which could lead to memory corruption or crashes. Such low-level memory issues may impact system stability and security, potentially affecting data integrity and confidentiality. However, the provided CVE details do not specify direct implications for compliance with GDPR or HIPAA.

Mitigation Strategies

Update your Linux kernel to the latest stable version where this vulnerability is patched. If immediate patching is not possible, disable the SMB sink as a perf AUX sink by removing the coresight ultrasoc-smb module or restricting its use in kernel configurations.

Hi! I’m here to help you understand CVE-2026-64402. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70