Executive brief
A vulnerability was identified in the Linux kernel's VME bus user-space driver, which is used for communication with specialized industrial hardware. An attacker could exploit this flaw to read or write data beyond the intended memory buffer, potentially leading to a system crash or unauthorized access to sensitive kernel memory. This issue primarily affects systems utilizing VME-based hardware interfaces.
Technical details
A slab-out-of-bounds vulnerability exists in the 'vme_user' staging driver within the Linux kernel. The SLAVE-path helper functions, buffer_to_user() and buffer_from_user(), fail to properly bound the 'count' and offset (*ppos) parameters against the fixed-size kernel buffer (kern_buf, 128 KiB). While the driver clamps the transfer size to the VME window size (which can be up to 4 GiB), it does not validate it against the actual allocated buffer size. A local attacker can trigger a read or write operation that exceeds the 128 KiB allocation, leading to a kernel crash (DoS) or potential information disclosure. The issue has been resolved by clamping the transfer count against the buffer size in both helper functions.
Affected products
- Linux Linux Kernel f00a86d98a1e to 6.10.1
Timeline
- 2026-06-18: other: Patch submitted by developer
- 2026-07-18: patched: Commits applied to stable branches
- 2026-07-25: disclosed: CVE published
References
- https://git.kernel.org/stable/c/1b495fa0d4927c88d88bf346bf311f2e26e860ed
- https://git.kernel.org/stable/c/65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed
- https://git.kernel.org/stable/c/8eff7cd4817e14dbe3b9952cce55ef52d1d38940
- https://git.kernel.org/stable/c/9f32f38265014fac7f5dc9490fb01a638ce6e121
- https://git.kernel.org/stable/c/adc8b9c30d716c362646edb45662aa1c641a154a
- https://git.kernel.org/stable/c/e99f2df433c63c86c93de1e5f08f16e404388756