CVE-2026-64449: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64449 Overview

CVE-2026-64449 is an out-of-bounds read/write vulnerability in the Linux kernel staging/vme_user driver. The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy count bytes into and out of the fixed-size kern_buf allocation using *ppos as the offset. Neither helper bounds *ppos + count against size_buf (PCI_BUF_SIZE == 0x20000, 128 KiB). When a VME window exceeds 128 KiB, a write() or read() call copies past the kern_buf allocation, producing a slab out-of-bounds access confirmed under KASAN.

Critical Impact
A local user with access to the vme_user character device can trigger a slab out-of-bounds read or write in kernel memory, enabling denial of service or potential local privilege escalation.

Affected Products

Linux kernel staging/vme_user driver (pre-patch)
Distributions shipping the affected staging driver prior to the fix commits
Systems with the vme_user or vme_fake bridge module loaded and accessible

Discovery Timeline

2026-07-25 - CVE-2026-64449 published to NVD
2026-07-27 - Last updated in NVD database

Technical Details for CVE-2026-64449

Vulnerability Analysis

The vulnerability resides in the SLAVE-path I/O helpers of the vme_user staging driver. The helpers buffer_to_user() and buffer_from_user() operate against a fixed-size kernel allocation named kern_buf, sized at PCI_BUF_SIZE (0x20000, 128 KiB). Both helpers use the file position *ppos as an offset into this buffer and copy count bytes without validating that *ppos + count remains within size_buf.

The higher-level vme_user_write() and vme_user_read() entry points only clamp count against the VME window size returned by vme_get_size(resource). That window size (image_size) is set through VME_SET_SLAVE from a user-supplied slave.size field. The ioctl validates the size against the VME address space (up to VME_A32_MAX, 4 GiB), not against the smaller PCI_BUF_SIZE backing buffer. When a caller configures a slave window larger than 128 KiB, subsequent write() or read() calls perform a copy_from_user() or copy_to_user() past the end of kern_buf.

Root Cause

The root cause is missing bounds validation between two independently sized objects: the user-controlled VME window (image_size) and the fixed backing buffer (size_buf). The SLAVE helpers trust the clamp performed against image_size and never re-clamp against size_buf. This is [CWE-787: Out-of-bounds Write] and [CWE-125: Out-of-bounds Read] in kernel slab memory.

Attack Vector

Exploitation requires local access to the vme_user character device and the ability to issue the VME_SET_SLAVE ioctl. An attacker configures a slave window larger than 0x20000 bytes, then issues a write() or read() with a count that pushes *ppos + count past the end of kern_buf. The KASAN report published with the patch demonstrates a Write of size 262144 at addr ffff888004100000 originating from vme_user_write through _copy_from_user. The out-of-bounds write corrupts adjacent slab objects, which can be leveraged for kernel memory corruption.

The upstream fix clamps count against size_buf inside both helpers and returns early when *ppos is already at or past the end of the buffer, mirroring the existing clamp in the MASTER-path helpers resource_to_user() and resource_from_user(). See the Kernel Git Commit e99f2df for the reference implementation.

Detection Methods for CVE-2026-64449

Indicators of Compromise

KASAN reports containing slab-out-of-bounds in _copy_from_user or _copy_to_user with a call stack including vme_user_write or vme_user_read
Kernel oops or panic traces referencing the vme_user module on systems where VME hardware is not expected
Unexpected loading of the vme_user or vme_fake kernel modules on production hosts

Detection Strategies

Audit /dev/vme_* device access and correlate with processes issuing VME_SET_SLAVE ioctls followed by large write() or read() calls
Enable KASAN in test and pre-production kernels to surface out-of-bounds slab accesses during fuzzing or regression runs
Monitor dmesg and journald for kernel warnings referencing vme_user helpers or slab corruption near VME module symbols

Monitoring Recommendations

Alert on module load events for vme_user and vme_fake on systems that do not use VME bus hardware
Track ioctl and file operation telemetry on VME character devices and flag unprivileged users interacting with them
Review kernel crash dumps for stack traces including buffer_to_user, buffer_from_user, vme_user_write, or vme_user_read

How to Mitigate CVE-2026-64449

Immediate Actions Required

Apply the upstream stable kernel updates that include the SLAVE-path bounds fix
Unload the vme_user and vme_fake modules on systems that do not require VME bus access
Restrict permissions on /dev/vme_* device nodes to trusted administrators only

Patch Information

The fix clamps count against size_buf in buffer_to_user() and buffer_from_user() and returns early when *ppos is at or past the end of the buffer. Patches are available in the following upstream commits: Kernel Git Commit 1b495fa, Kernel Git Commit 65358d8, Kernel Git Commit 8eff7cd, Kernel Git Commit 9f32f38, Kernel Git Commit adc8b9c, and Kernel Git Commit e99f2df.

Workarounds

Blacklist the vme_user and vme_fake modules using /etc/modprobe.d/ configuration on hosts without VME hardware
Enforce strict file permissions and ACLs on VME character devices to prevent unprivileged access
Rebuild kernels without CONFIG_VME_USER where the staging driver is not required

bash

# Configuration example
# Blacklist vme_user and vme_fake modules
echo "blacklist vme_user" | sudo tee /etc/modprobe.d/blacklist-vme.conf
echo "blacklist vme_fake" | sudo tee -a /etc/modprobe.d/blacklist-vme.conf

# Unload if currently loaded
sudo modprobe -r vme_user
sudo modprobe -r vme_fake

# Restrict device node access
sudo chmod 600 /dev/vme_*