CVE-2026-64449

Awaiting Analysis Awaiting Analysis - Queue

Buffer Overflow in Linux Kernel VME User Driver

Publication date: 2026-07-25

Last updated on: 2026-08-11

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without bounding *ppos + count against size_buf. vme_user_write()/vme_user_read() only clamp count to the VME window size (image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the user-supplied slave.size -- validated against the VME address space (up to VME_A32_MAX = 4 GiB), not against PCI_BUF_SIZE. When the window exceeds 128 KiB, a write()/read() copies past the kern_buf allocation. Clamp count against size_buf in both helpers, with an early return when *ppos is already at/after the buffer end. *ppos is >= 0 here (the caller rejects negative offsets), so size_buf - *ppos cannot wrap. This mirrors the existing clamp in the MASTER-path helpers resource_to_user() / resource_from_user(), and matches the read()/write() convention of a short transfer at end-of-buffer. Found by static analysis (CodeQL taint tracking + CBMC bounded model checking) and confirmed dynamically under KASAN with the vme_fake bridge: BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x2d/0x80 Write of size 262144 at addr ffff888004100000 by task trigger/68 _copy_from_user+0x2d/0x80 vme_user_write+0x13e/0x240 [vme_user] vfs_write+0x1b8/0x7a0 ksys_write+0xb8/0x150

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-25

Last Modified

2026-08-11

Generated

2026-08-14

AI Q&A

2026-07-25

EPSS Evaluated

2026-08-13

NVD

CVE-2026-64449

EUVD

EUVD-2026-48793

Affected Vendors & Products

Vendor	Product	Version / Range
linux_kernel	vme_user	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This vulnerability in the Linux kernel involves the staging driver vme_user. The issue occurs when reading or writing data through the SLAVE-path helpers buffer_to_user() and buffer_from_user(). These functions copy data into or out of a fixed-size buffer (kern_buf) without properly checking if the combined offset and data size exceed the buffer's limit. This can lead to a buffer overflow when the user-supplied data size is larger than the buffer's capacity.

Detection Guidance

This vulnerability is specific to the Linux kernel's vme_user module and requires static analysis or dynamic testing with KASAN to detect. No direct network detection commands are applicable. Use static analysis tools like CodeQL or CBMC to scan the kernel code for the described buffer overflow pattern.

Impact Analysis

This vulnerability could allow an attacker to write or read data beyond the allocated buffer in the kernel. This may result in memory corruption, crashes, or potentially privilege escalation. An attacker with local access could exploit this to execute arbitrary code in the kernel context, leading to system compromise.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards as it is a low-level kernel memory corruption issue in the Linux VME subsystem. Standards like GDPR and HIPAA focus on data protection and privacy, while this issue relates to memory safety in device driver code. No evidence suggests this vulnerability impacts regulated data handling or privacy controls.

Mitigation Strategies

Apply the kernel patch that clamps the count against size_buf in vme_user_write() and vme_user_read(). Disable the vme_user module if not in use. Monitor kernel updates from your distribution for a fix.

Hi! I’m here to help you understand CVE-2026-64449. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70