Junglewise Threat Intelligence

CVE-2026-64449: Linux Kernel slab-out-of-bounds in vme_user driver

CVE-2026-64449 · Severity: info · CVSS 0 · Published 2026-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability was identified in the Linux kernel's VME bus user-space driver, which is used for communication with specialized industrial hardware. An attacker could exploit this flaw to read or write data beyond the intended memory buffer, potentially leading to a system crash or unauthorized access to sensitive kernel memory. This issue primarily affects systems utilizing VME-based hardware interfaces.

Technical details

A slab-out-of-bounds vulnerability exists in the 'vme_user' staging driver within the Linux kernel. The SLAVE-path helper functions, buffer_to_user() and buffer_from_user(), fail to properly bound the 'count' and offset (*ppos) parameters against the fixed-size kernel buffer (kern_buf, 128 KiB). While the driver clamps the transfer size to the VME window size (which can be up to 4 GiB), it does not validate it against the actual allocated buffer size. A local attacker can trigger a read or write operation that exceeds the 128 KiB allocation, leading to a kernel crash (DoS) or potential information disclosure. The issue has been resolved by clamping the transfer count against the buffer size in both helper functions.

Affected products

  • Linux Linux Kernel f00a86d98a1e to 6.10.1

Timeline

  • 2026-06-18: other: Patch submitted by developer
  • 2026-07-18: patched: Commits applied to stable branches
  • 2026-07-25: disclosed: CVE published

References

Related threats