CVE-2026-64449

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

staging: vme_user: bound slave read/write to the kern_buf size

The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy

'count' bytes into/out of the fixed-size kern_buf (size_buf ==

PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without

bounding *ppos + count against size_buf.

vme_user_write()/vme_user_read() only clamp count to the VME window size

(image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the

user-supplied slave.size -- validated against the VME address space (up

to VME_A32_MAX = 4 GiB), not against PCI_BUF_SIZE. When the window

exceeds 128 KiB, a write()/read() copies past the kern_buf allocation.

Clamp count against size_buf in both helpers, with an early return when

*ppos is already at/after the buffer end. *ppos is >= 0 here (the caller

rejects negative offsets), so size_buf - *ppos cannot wrap. This mirrors

the existing clamp in the MASTER-path helpers r

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References