CVE-2026-64402: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64402 Overview

CVE-2026-64402 is an out-of-bounds write vulnerability in the Linux kernel's coresightultrasoc-smb driver. The flaw resides in smb_sync_perf_buffer(), which copies hardware trace data into the perf AUX ring buffer pages when the System Memory Buffer (SMB) sink is used as a perf AUX sink. The function derives pg_idx = head >> PAGE_SHIFT from handle->head and indexes dst_pages[pg_idx] without first normalizing head modulo the AUX buffer size. When head exceeds the AUX buffer size, the driver writes past the dst_pages[] array, corrupting adjacent kernel memory.

Critical Impact
A local authenticated user with access to CoreSight perf tracing can trigger an out-of-bounds kernel write, enabling potential privilege escalation or kernel memory corruption.

Affected Products

Linux kernel versions containing the coresightultrasoc-smb driver prior to the fix commits
Systems using ARM CoreSight System Memory Buffer as a perf AUX sink
Distributions shipping vulnerable stable kernel branches referenced by the upstream fixes

Discovery Timeline

2026-07-25 - CVE-2026-64402 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64402

Vulnerability Analysis

The vulnerability is an out-of-bounds write [CWE-787] in the smb_sync_perf_buffer() function of the Linux kernel's Ultrasoc System Memory Buffer (SMB) CoreSight sink driver. When the SMB sink acts as a perf AUX sink, smb_update_buffer() invokes smb_sync_perf_buffer() to transfer hardware trace data into perf AUX ring buffer pages.

The function computes the destination page index directly from handle->head using pg_idx = head >> PAGE_SHIFT and then writes to dst_pages[pg_idx]. The required pg_idx %= nr_pages normalization is only applied after the first loop iteration, leaving the initial index unbounded relative to the actual page array size.

Exploitation writes kernel data beyond the dst_pages[] array, corrupting adjacent memory structures. The impact includes kernel memory corruption, denial of service through kernel panic, and potential local privilege escalation depending on the layout of adjacent allocations.

Root Cause

The root cause is missing input normalization on the head offset before it is used to derive a page array index. The developer assumed head would always fall within the AUX buffer bounds, but no invariant enforces this before the first iteration of the copy loop. The fix normalizes head modulo the AUX buffer size before deriving the page index and offset, mirroring the correct pattern already used in tmc_etr_sync_perf_buffer().

Attack Vector

Exploitation requires local access with permissions to configure and run perf against the CoreSight SMB sink. An attacker crafts a perf AUX buffer configuration and drives handle->head past the buffer size, causing smb_sync_perf_buffer() to compute an out-of-range pg_idx and write hardware trace data into memory adjacent to dst_pages[]. The vulnerability is limited to systems where the ultrasoc-smb driver is loaded and accessible.

Detection Methods for CVE-2026-64402

Indicators of Compromise

Unexpected kernel oops, panics, or slab corruption warnings referencing smb_sync_perf_buffer or smb_update_buffer in dmesg
Non-root or unprivileged processes accessing CoreSight sysfs entries under /sys/bus/coresight/devices/ for SMB sinks
Anomalous perf_event_open syscalls targeting CoreSight AUX sinks from non-administrative users

Detection Strategies

Monitor kernel logs for KASAN reports flagging out-of-bounds writes in the coresight-ultrasoc-smb module
Audit process execution of perf record with -e cs_etm// or SMB sink configurations from unexpected user contexts
Correlate kernel module load events for ultrasoc_smb with subsequent perf AUX buffer activity

Monitoring Recommendations

Enable KASAN and kernel lockdown on test systems to surface the OOB write during validation
Ingest auditd records for perf_event_open and CoreSight device access into a centralized logging pipeline
Track kernel version and patch state across Linux fleets to identify hosts still exposed

How to Mitigate CVE-2026-64402

Immediate Actions Required

Apply the upstream stable kernel patches referenced in the CVE record and rebuild affected kernels
Restrict access to CoreSight perf AUX sinks by tightening perf_event_paranoid and file permissions on /sys/bus/coresight/devices/
Unload the ultrasoc_smb module on systems that do not require CoreSight SMB tracing

Patch Information

The issue is resolved in stable Linux kernel commits 38dbc8db8341, 4c5a0a946373, 661a019ac041, 98495b5a4d77, and daf6246ab988. The fix normalizes head modulo the AUX buffer size before deriving the page index and offset in smb_sync_perf_buffer().

Workarounds

Set kernel.perf_event_paranoid=3 via sysctl to prevent unprivileged users from opening perf events
Blacklist the ultrasoc_smb module on systems that do not need CoreSight SMB tracing to eliminate the attack surface
Restrict CoreSight sysfs permissions to root-only groups until patched kernels are deployed

bash

# Configuration example
# Restrict perf to root and blacklist the vulnerable module
echo 'kernel.perf_event_paranoid=3' | sudo tee /etc/sysctl.d/99-perf-hardening.conf
sudo sysctl --system

echo 'blacklist ultrasoc_smb' | sudo tee /etc/modprobe.d/blacklist-ultrasoc-smb.conf
sudo rmmod ultrasoc_smb 2>/dev/null || true