CVE Explorer

CVE-2026-64449

In the Linux kernel, the following vulnerability has been resolved: staging: vme_user: bound slave read/write to the kern_buf size The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without bounding *ppos + count against size_buf. vme_user_write()/vme_user_read() only clamp count to the VME window size (image_size = vme_get_size(resource)), which VME_SET

Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:36021ee7b9fb1c7467f59312b7b09a199d87c8d69d562d7d449b8c9d564402a1

Known exploited

Not asserted

Disputed

Stale source

Conflicts

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/staging/vme_user/vme_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed","status":"affected","version":"f00a86d98a1ec3e99d352cda926fab767ba43b1f","versionType":"git"},{"lessThan":"adc8b9c30d716c362646edb45662aa1c641a154a","status":"affected","version":"f00a86d98a1ec3e99d352cda926fab767ba43b1f","versionType":"git"},{"lessThan":"8eff7cd4817e14dbe3b9952cce55ef52d1d38940","status":"affected","version":"f00a86d98a…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:62702617add3a975d18f86c42d30b81ba73e7a3f6a74105751df43ff39d9a970 · sha256:3ab652286723410a… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/staging/vme_user/vme_user.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"2.6.32"},{"lessThan":"2.6.32","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.1.*","status":"unaffected","version":"6.1.178","versionType":"semver"},{"lessThanOrEqual":"6.6.*","status":"unaffected","version":"6.6.145","versionType":"semver"},{"lessThanOrEqual":"6.12.*","status":"unaffected","version":"6.12.96","versionType":"sem…

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:62702617add3a975d18f86c42d30b81ba73e7a3f6a74105751df43ff39d9a970 · sha256:3ab652286723410a… · /containers/cna/affected/1

Affected products and versions

2 source assertions

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:62702617add3a975d18f86c42d30b81ba73e7a3f6a74105751df43ff39d9a970 · sha256:3ab652286723410a… · /containers/cna/affected/0

cve_program_cvelist_v5affected
urn:baitaphish:normalized-source-record:v2:62702617add3a975d18f86c42d30b81ba73e7a3f6a74105751df43ff39d9a970 · sha256:3ab652286723410a… · /containers/cna/affected/1

Provider-owned CVSS observations

1 source assertion

{"metric":{"baseScore":7.8,"baseSeverity":"HIGH","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","version":"3.1"},"metric_type":"cvssV3_1"}

cve_program_cvelist_v5cvss
urn:baitaphish:normalized-source-record:v2:62702617add3a975d18f86c42d30b81ba73e7a3f6a74105751df43ff39d9a970 · sha256:3ab652286723410a… · /containers/cna/metrics/0/cvssV3_1

Source references

6 source assertions

{"url":"https://git.kernel.org/stable/c/1b495fa0d4927c88d88bf346bf311f2e26e860ed"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:62702617add3a975d18f86c42d30b81ba73e7a3f6a74105751df43ff39d9a970 · sha256:3ab652286723410a… · /containers/cna/references/4

{"url":"https://git.kernel.org/stable/c/65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:62702617add3a975d18f86c42d30b81ba73e7a3f6a74105751df43ff39d9a970 · sha256:3ab652286723410a… · /containers/cna/references/0

{"url":"https://git.kernel.org/stable/c/8eff7cd4817e14dbe3b9952cce55ef52d1d38940"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:62702617add3a975d18f86c42d30b81ba73e7a3f6a74105751df43ff39d9a970 · sha256:3ab652286723410a… · /containers/cna/references/2

{"url":"https://git.kernel.org/stable/c/9f32f38265014fac7f5dc9490fb01a638ce6e121"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:62702617add3a975d18f86c42d30b81ba73e7a3f6a74105751df43ff39d9a970 · sha256:3ab652286723410a… · /containers/cna/references/5

{"url":"https://git.kernel.org/stable/c/adc8b9c30d716c362646edb45662aa1c641a154a"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:62702617add3a975d18f86c42d30b81ba73e7a3f6a74105751df43ff39d9a970 · sha256:3ab652286723410a… · /containers/cna/references/1

{"url":"https://git.kernel.org/stable/c/e99f2df433c63c86c93de1e5f08f16e404388756"}

cve_program_cvelist_v5reference
urn:baitaphish:normalized-source-record:v2:62702617add3a975d18f86c42d30b81ba73e7a3f6a74105751df43ff39d9a970 · sha256:3ab652286723410a… · /containers/cna/references/3

Attribution and limitations

CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer