{
  "cveId": "CVE-2026-64449",
  "url": "https://patchblox.com/security/cve/CVE-2026-64449",
  "summary": "CVE-2026-64449 is fixed in 2 products on 1 platform, first by DEBIAN-CVE-2026-64449, released July 26, 2026. It is not reported as exploited. Patch Radar priority: High.",
  "title": "linux: In the Linux kernel, the following vulnerability has been resolved:  staging: vme_user: bound slave read/write to the...",
  "description": "In the Linux kernel, the following vulnerability has been resolved:  staging: vme_user: bound slave read/write to the kern_buf size  The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy \u0027count\u0027 bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without bounding *ppos \u002B count against size_buf.  vme_user_write()/vme_user_read() only clamp count to the VME window size (image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the user-supplied slave.size -- validated against the VME address space (up to VME_A32_MAX = 4 GiB), not against PCI_BUF_SIZE.  When the window exceeds 128 KiB, a write()/read() copies past the kern_buf allocation.  Clamp count against size_buf in both helpers, with an early return when *ppos is already at/after the buffer end.  *ppos is \u003E= 0 here (the caller rejects negative offsets), so size_buf - *ppos cannot wrap.  This mirrors the existing clamp in the MASTER-path helpers resource_to_user() / resource_from_user(), and matches the read()/write() convention of a short transfer at end-of-buffer.  Found by static analysis (CodeQL taint tracking \u002B CBMC bounded model checking) and confirmed dynamically under KASAN with the vme_fake bridge:    BUG: KASAN: slab-out-of-bounds in _copy_from_user\u002B0x2d/0x80   Write of size 262144 at addr ffff888004100000 by task trigger/68     _copy_from_user\u002B0x2d/0x80     vme_user_write\u002B0x13e/0x240 [vme_user]     vfs_write\u002B0x1b8/0x7a0     ksys_write\u002B0xb8/0x150",
  "published": "2026-07-25T10:17:29Z",
  "severity": "high",
  "cvss": 7.8,
  "cvssVector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
  "epss": 0.00139,
  "epssPercentile": 0.03265,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.1.180-1",
      "fix": "DEBIAN-CVE-2026-64449",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64449",
      "released": "2026-07-26T13:52:50Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "6.12.96-1",
      "fix": "DEBIAN-CVE-2026-64449",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64449",
      "released": "2026-07-26T13:52:50Z"
    },
    {
      "platform": "linux",
      "product": "linux",
      "release": "Debian 14",
      "fixedVersion": "7.1.4-1",
      "fix": "DEBIAN-CVE-2026-64449",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64449",
      "released": "2026-07-26T13:52:50Z"
    },
    {
      "platform": "linux",
      "product": "linux-6.12",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "6.12.100-1~deb12u1",
      "fix": "DEBIAN-CVE-2026-64449",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2026-64449",
      "released": "2026-07-26T13:52:50Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}