SECUFOCUSNOW
Home›CVE index›CVE-2026-64449
Review reviewHigh

CVE-2026-64449

Linux

In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without bounding *ppos + count against size_buf. vme_user_write()/vme_user_read() only clamp count to the VME window size (image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the user-supplied slave.size -- validated against the VME address space (up to VME_...

CVSS
7.8
EPSS
-
- percentile
CISA KEV
Not listed
Published
2026.07.25
PRIORITY ASSESSMENT

Review review

The CVSS severity warrants an early asset and exposure review.

Known exploitationNot established by KEV
Exploit probability-
Technical severityCVSS 7.8

Vulnerability overview

In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without bounding *ppos + count against size_buf. vme_user_write()/vme_user_read() only clamp count to the VME window size (image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the user-supplied slave.size -- validated against the VME address space (up to VME_...

Affected product and versions

Product
Linux
Affected versions
>= f00a86d98a1ec3e99d352cda926fab767ba43b1f < 65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed, >= f00a86d98a1ec3e99d352cda926fab767ba43b1f < adc8b9c30d716c362646edb45662aa1c641a154a, >= f00a86d98a1ec3e99d352cda926fab767ba43b1f < 8eff7cd4817e14dbe3b9952cce55ef52d1d38940, >= f00a86d98a1ec3e99d352cda926fab767ba43b1f < e99f2df433c63c86c93de1e5f08f16e404388756, >= f00a86d98a1ec3e99d352cda926fab767ba43b1f < 1b495fa0d4927c88d88bf346bf311f2e26e860ed, >= f00a86d98a1ec3e99d352cda926fab767ba43b1f < 9f32f38265014fac7f5dc9490fb01a638ce6e121, >= 2.6.32
Fixed versions
No verified fixed-version field is available yet

Recommended response sequence

Confirm exposure before applying a vendor-supported change.

Full remediation guide
  1. 1
    Identify

    Confirm that Linux and an affected version are present.

  2. 2
    Prioritize

    Combine exploitation signals with asset exposure and business criticality.

  3. 3
    Remediate

    Follow the vendor advisory or supported update path and preserve rollback options.

  4. 4
    Verify

    Recheck the version, service health, access paths, and relevant logs.

Technical data

CVSS vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE
Not available
CVE-2026-64449 — Linux | SECUFOCUS NOW