CVE-2026-64449: staging: vme_user: bound slave read/write to the kern_buf size
In the Linux kernel, the following vulnerability has been resolved:
staging: vmeuser: bound slave read/write to the kernbuf size
The SLAVE-path helpers buffertouser() and bufferfromuser() copy 'count' bytes into/out of the fixed-size kernbuf (sizebuf == PCIBUFSIZE == 0x20000, 128 KiB) using ppos as the offset, without bounding ppos + count against sizebuf.
vmeuserwrite()/vmeuserread() only clamp count to the VME window size (imagesize = vmegetsize(resource)), which VMESETSLAVE sets from the user-supplied slave.size -- validated against the VME address space (up to VMEA32MAX = 4 GiB), not against PCIBUFSIZE. When the window exceeds 128 KiB, a write()/read() copies past the kernbuf allocation.
Clamp count against sizebuf in both helpers, with an early return when ppos is already at/after the buffer end. ppos is >= 0 here (the caller rejects negative offsets), so sizebuf - ppos cannot wrap. This mirrors the existing clamp in the MASTER-path helpers resourcetouser() / resourcefromuser(), and matches the read()/write() convention of a short transfer at end-of-buffer.
Found by static analysis (CodeQL taint tracking + CBMC bounded model checking) and confirmed dynamically under KASAN with the vmefake bridge:
BUG: KASAN: slab-out-of-bounds in copyfromuser+0x2d/0x80 Write of size 262144 at addr ffff888004100000 by task trigger/68 copyfromuser+0x2d/0x80 vmeuserwrite+0x13e/0x240 [vmeuser] vfswrite+0x1b8/0x7a0 ksyswrite+0xb8/0x150
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In the SLAVE-path helpers buffer_to_user() and buffer_from_user(), clamp the user copy length by bounding (*ppos + count) against size_buf (PCI_BUF_SIZE). Add an early return when the transfer would exceed the kern_buf allocation (128 KiB / 0x20000). Ensure the slave helpers cannot copy past kern_buf when *ppos is at/after the buffer end.
Linux kernel VME staging driver (vme_user / vme_user_read-vme_user_write, slave path helpers buffer_to_user() and buffer_from_user()) Clamp bounds for slave path user copy (bound *ppos + count against size_buf == PCI_BUF_SIZE) with early return on overflow/end-of-buffer = Implemented: bound *ppos + count against size_buf (PCI_BUF_SIZE == 0x20000) and add early return when the requested transfer exceeds the buffer; also reject negative offsets via existing checks
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
An attacker needs local access and low privileges, as indicated by the CVSS vector. Exploitation requires access to the VME user interface and the ability to configure a slave window larger than the fixed 128 KiB kernel buffer.
Which systems are exposed?
Systems using the Linux kernel staging vme_user driver are exposed when the SLAVE-path read or write interface is used with a VME slave window exceeding 128 KiB. The affected condition depends on the configured slave window size, not merely the presence of the driver.
What happens when the vulnerable path is reached?
A read or write can copy beyond the fixed-size kern_buf allocation because the transfer is limited by the VME window size rather than the 128 KiB buffer size. This can affect confidentiality, integrity, and availability.
How can exposure be reduced before applying the fix?
Avoid using SLAVE-path reads or writes with VME slave windows larger than 128 KiB. Restrict local access to accounts and processes that can access and configure the VME user interface.
How does the fix change behavior at the buffer boundary?
The fix limits transfers to the remaining space in kern_buf and returns early if the file offset is already at or beyond the 128 KiB buffer end. Reads and writes may therefore complete as short transfers at the end of the buffer.