CVE-2026-64449

*** Pendiente de traducción *** In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> staging: vme_user: bound slave read/write to the kern_buf size<br /> <br /> The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy<br /> &amp;#39;count&amp;#39; bytes into/out of the fixed-size kern_buf (size_buf ==<br /> PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without<br /> bounding *ppos + count against size_buf.<br /> <br /> vme_user_write()/vme_user_read() only clamp count to the VME window size<br /> (image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the<br /> user-supplied slave.size -- validated against the VME address space (up<br /> to VME_A32_MAX = 4 GiB), not against PCI_BUF_SIZE. When the window<br /> exceeds 128 KiB, a write()/read() copies past the kern_buf allocation.<br /> <br /> Clamp count against size_buf in both helpers, with an early return when<br /> *ppos is already at/after the buffer end. *ppos is &gt;= 0 here (the caller<br /> rejects negative offsets), so size_buf - *ppos cannot wrap. This mirrors<br /> the existing clamp in the MASTER-path helpers resource_to_user() /<br /> resource_from_user(), and matches the read()/write() convention of a<br /> short transfer at end-of-buffer.<br /> <br /> Found by static analysis (CodeQL taint tracking + CBMC bounded model<br /> checking) and confirmed dynamically under KASAN with the vme_fake bridge:<br /> <br /> BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x2d/0x80<br /> Write of size 262144 at addr ffff888004100000 by task trigger/68<br /> _copy_from_user+0x2d/0x80<br /> vme_user_write+0x13e/0x240 [vme_user]<br /> vfs_write+0x1b8/0x7a0<br /> ksys_write+0xb8/0x150