Answer in brief
CVE-2026-64449 records a Unknown severity vulnerability in staging: vme_user: bound slave read/write to the kern_buf size. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f00a86d98a1ec3e99d352cda926fab767ba43b1f <65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed || >=f00a86d98a1ec3e99d352cda926fab767ba43b1f <adc8b9c30d716c362646edb45662aa1c641a154a || >=f00a86d98a1ec3e99d352cda926fab767ba43b1f <8eff7cd4817e14dbe3b9952cce55ef52d1d38940 || >=f00a86d98a1ec3e99d352cda926fab767ba43b1f <e99f2df433c63c86c93de1e5f08f16e404388756 || >=f00a86d98a1ec3e99d352cda926fab767ba43b1f <1b495fa0d4927c88d88bf346bf311f2e26e860ed || >=f00a86d98a1ec3e99d352cda926fab767ba43b1f <9f32f38265014fac7f5dc9490fb01a638ce6e121 | 65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed, adc8b9c30d716c362646edb45662aa1c641a154a, 8eff7cd4817e14dbe3b9952cce55ef52d1d38940, e99f2df433c63c86c93de1e5f08f16e404388756, 1b495fa0d4927c88d88bf346bf311f2e26e860ed, 9f32f38265014fac7f5dc9490fb01a638ce6e121 |
| Linux/Linuxgeneric | 2.6.32 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without bounding *ppos + count against size_buf. vme_user_write()/vme_user_read() only clamp count to the VME window size (image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the user-supplied slave.size -- validated against the VME address space (up to VME_A32_MAX = 4 GiB), not against PCI_BUF_SIZE. When the window exceeds 128 KiB, a write()/read() copies past the kern_buf allocation. Clamp count against size_buf in both helpers, with an early return when *ppos is already at/after the buffer end. *ppos is >= 0 here (the caller rejects negative offsets), so size_buf - *ppos cannot wrap. This mirrors the existing clamp in the MASTER-path helpers resource_to_user() / resource_from_user(), and matches the read()/write() convention of a short transfer at end-of-buffer. Found by static analysis (CodeQL taint tracking + CBMC bounded model checking) and confirmed dynamically under KASAN with the vme_fake bridge: BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x2d/0x80 Write of size 262144 at addr ffff888004100000 by task trigger/68 _copy_from_user+0x2d/0x80 vme_user_write+0x13e/0x240 [vme_user] vfs_write+0x1b8/0x7a0 ksys_write+0xb8/0x150
Quoted source text, attributed separately from HOL analysis.
Answer in brief
CVE-2026-64449 records a Unknown severity vulnerability in staging: vme_user: bound slave read/write to the kern_buf size. The current sources do not mark it as known exploited. The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps Linux/Linux (generic), Linux/Linux (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| Linux/Linuxgeneric | >=f00a86d98a1ec3e99d352cda926fab767ba43b1f <65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed || >=f00a86d98a1ec3e99d352cda926fab767ba43b1f <adc8b9c30d716c362646edb45662aa1c641a154a || >=f00a86d98a1ec3e99d352cda926fab767ba43b1f <8eff7cd4817e14dbe3b9952cce55ef52d1d38940 || >=f00a86d98a1ec3e99d352cda926fab767ba43b1f <e99f2df433c63c86c93de1e5f08f16e404388756 || >=f00a86d98a1ec3e99d352cda926fab767ba43b1f <1b495fa0d4927c88d88bf346bf311f2e26e860ed || >=f00a86d98a1ec3e99d352cda926fab767ba43b1f <9f32f38265014fac7f5dc9490fb01a638ce6e121 | 65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed, adc8b9c30d716c362646edb45662aa1c641a154a, 8eff7cd4817e14dbe3b9952cce55ef52d1d38940, e99f2df433c63c86c93de1e5f08f16e404388756, 1b495fa0d4927c88d88bf346bf311f2e26e860ed, 9f32f38265014fac7f5dc9490fb01a638ce6e121 |
| Linux/Linuxgeneric | 2.6.32 | Not reported |
Published upstream
Jul 25, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 5, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 5, 2026
In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without bounding *ppos + count against size_buf. vme_user_write()/vme_user_read() only clamp count to the VME window size (image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the user-supplied slave.size -- validated against the VME address space (up to VME_A32_MAX = 4 GiB), not against PCI_BUF_SIZE. When the window exceeds 128 KiB, a write()/read() copies past the kern_buf allocation. Clamp count against size_buf in both helpers, with an early return when *ppos is already at/after the buffer end. *ppos is >= 0 here (the caller rejects negative offsets), so size_buf - *ppos cannot wrap. This mirrors the existing clamp in the MASTER-path helpers resource_to_user() / resource_from_user(), and matches the read()/write() convention of a short transfer at end-of-buffer. Found by static analysis (CodeQL taint tracking + CBMC bounded model checking) and confirmed dynamically under KASAN with the vme_fake bridge: BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x2d/0x80 Write of size 262144 at addr ffff888004100000 by task trigger/68 _copy_from_user+0x2d/0x80 vme_user_write+0x13e/0x240 [vme_user] vfs_write+0x1b8/0x7a0 ksys_write+0xb8/0x150
Quoted source text, attributed separately from HOL analysis.