CVE-2026-64318 Overview
CVE-2026-64318 is an out-of-bounds read vulnerability in the Linux kernel's AIX partition parser. The flaw resides in aix_partition() within the block layer partition scanning code. The function reads an unvalidated pp_count value from an on-disk AIX physical volume descriptor and uses it to iterate the fixed-size ppe[] array inside struct pvd. A crafted partition table can drive the loop to read up to 65,535 entries against a 1,016-entry array, exposing roughly 2 MB of kernel memory beyond the allocation.
Critical Impact
A local attacker who can attach a crafted block device triggers a kernel out-of-bounds read that can leak kernel memory or crash the host.
Affected Products
- Linux kernel (mainline) with AIX partition support enabled in the block layer
- Linux stable branches prior to the fix commits listed in the kernel.org references
- Distribution kernels shipping the vulnerable partitions/aix.c code path
Discovery Timeline
- 2026-07-25 - CVE-2026-64318 published to NVD
- 2026-07-27 - Last updated in NVD database
Technical Details for CVE-2026-64318
Vulnerability Analysis
The defect is an Out-of-Bounds Read [CWE-125] in the AIX/IBM partition table parser invoked during block device scanning. aix_partition() allocates a single struct pvd via kmalloc(). The structure embeds a fixed-length ppe[] array sized at ARRAY_SIZE(pvd->ppe) (1016 entries). The function then reads pp_count, a big-endian 16-bit field from the descriptor, and uses that value directly as the loop bound.
Because pp_count originates from attacker-controlled on-disk data and is not validated against the array capacity, values above 1016 cause the loop to dereference pvd->ppe + i past the end of the allocation. With the maximum __be16 value of 65,535, the read walks approximately 2 MB beyond the allocated buffer. The read of p->lp_ix returns adjacent kernel heap contents, which can either leak sensitive data or trigger a page fault leading to a kernel crash.
Root Cause
The root cause is missing input validation of a length field parsed from untrusted media. The kernel treats be16_to_cpu(pvd->pp_count) as authoritative without clamping it to the compiled-in ppe[] array size. The fix bounds numpps to ARRAY_SIZE(pvd->ppe) before the scan begins.
Attack Vector
Exploitation requires the ability to introduce a block device with a crafted AIX/IBM partition table. Two realistic paths exist: a local user with permission to run losetup -P on an attacker-supplied image, or a physical or virtualized attacker who inserts removable media that udev auto-scans. Partition parsing runs before any filesystem is mounted, so no additional privileges beyond device attachment are required. The scan is reached through msdos_partition() calling into aix_partition().
No public proof-of-concept exploit is listed in the enriched CVE data. The vulnerability mechanism is described in the upstream commits referenced by kernel.org, including Kernel Git Commit 0986165 and Kernel Git Commit fd94a77.
Detection Methods for CVE-2026-64318
Indicators of Compromise
- Unexpected losetup or loop-device attachment events originating from non-administrative users or automation accounts.
- Kernel log entries referencing aix_partition, msdos_partition, or general-protection or page faults during block device probing.
- Unusual udev block device add events immediately followed by kernel oops messages or system instability.
Detection Strategies
- Audit mount, losetup, and block device hotplug telemetry for images with AIX/IBM partition signatures from untrusted sources.
- Enable and monitor kernel oops and panic reporting to catch out-of-bounds reads that manifest as faults in partition scanning.
- Correlate udev block device events with subsequent kernel warnings across the fleet to identify attempted exploitation.
Monitoring Recommendations
- Forward /var/log/kern.log, dmesg, and journald kernel facility events into a central log store for retention and query.
- Alert on any kernel stack trace containing aix_partition or adjacent block layer partition parsers.
- Track privileged use of losetup -P, kpartx, and image-mount utilities by non-standard users or containers.
How to Mitigate CVE-2026-64318
Immediate Actions Required
- Apply the upstream Linux kernel patches referenced on kernel.org and reboot into the patched kernel.
- Restrict which users and processes may attach loop devices or mount removable media, ideally limiting these operations to trusted administrators.
- Disable AIX partition table support in custom kernel builds where it is not required by disabling CONFIG_AIX_PARTITION.
Patch Information
The fix clamps numpps to ARRAY_SIZE(pvd->ppe) in block/partitions/aix.c, preventing the loop from reading past the allocated buffer. Backports are available across stable branches. Relevant commits include Kernel Git Commit 2dc0bfd, Kernel Git Commit 44f37ee, Kernel Git Commit 4671bb7, Kernel Git Commit 5eacdb1, Kernel Git Commit b5e9c09, and Kernel Git Commit ce93228. Consume the fix through your distribution's kernel update channel.
Workarounds
- Configure udev rules to skip automatic partition scanning of removable and loop devices from untrusted sources.
- Remove or restrict the loop kernel module on systems that do not require loop-device functionality.
- Enforce least privilege on container and virtualization hosts so unprivileged workloads cannot attach block devices with attacker-controlled partition tables.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
