CVE-2026-64402

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()<br /> <br /> When the SMB sink is used as a perf AUX sink, smb_update_buffer() calls<br /> smb_sync_perf_buffer() to copy hardware trace data into the perf AUX ring<br /> buffer pages. It derives pg_idx = head &gt;&gt; PAGE_SHIFT from @head, which is<br /> handle-&gt;head, and indexes dst_pages[pg_idx]. The pg_idx %= nr_pages<br /> normalization is only applied after the first loop iteration.<br /> <br /> This leaves the initial page index underived from the buffer size, which<br /> can result in an out-of-bounds write past dst_pages[] when head exceeds<br /> the AUX buffer size.<br /> <br /> Normalize head modulo the AUX buffer size before deriving the page index<br /> and offset, mirroring tmc_etr_sync_perf_buffer().