CVE-2026-64318

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> partitions: aix: bound the pp_count scan to the ppe array<br /> <br /> aix_partition() reads the physical volume descriptor into a fixed-size<br /> struct pvd and then scans its physical-partition-extent array:<br /> <br /> int numpps = be16_to_cpu(pvd-&gt;pp_count);<br /> ...<br /> for (i = 0; i ppe + i;<br /> ...<br /> lp_ix = be16_to_cpu(p-&gt;lp_ix);<br /> <br /> pvd points at a single kmalloc()&amp;#39;d struct pvd whose ppe[] member holds a<br /> fixed ARRAY_SIZE(pvd-&gt;ppe) (1016) entries, but the loop runs up to the<br /> on-disk pp_count. pp_count is an unvalidated __be16 read straight from<br /> the descriptor, so a crafted AIX image with pp_count larger than 1016<br /> drives the loop to read pvd-&gt;ppe[i] past the end of the allocation (up<br /> to 65535 entries, ~2 MB out of bounds).<br /> <br /> The partition scan runs without mounting anything, when a block device<br /> with a crafted AIX/IBM partition table appears (an attacker-supplied<br /> image attached with losetup -P, or a device auto-scanned by udev), via<br /> msdos_partition() -&gt; aix_partition().<br /> <br /> Clamp the scan to the number of entries the ppe[] array can hold.