CVE-2026-64449

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the staging vme user component where the SLAVE-path helper functions buffer to user() and buffer from user() fail to properly bound the sum of the offset *ppos and the count of bytes against the fixed-size kern buf (128 KiB). While vme user write() and vme user read() clamp the count to the VME window size, this size is validated against the VME address space (up to 4 GiB) rather than the kern buf size. Consequently, if the window exceeds 128 KiB, a read or write operation can copy data beyond the kern buf allocation, leading to a slab-out-of-bounds memory access.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.