CVE-2026-64449: staging: vme_user: bound slave read/write to the kern_buf size

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

staging: vme_user: bound slave read/write to the kern_buf size

The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy
'count' bytes into/out of the fixed-size kern_buf (size_buf ==
PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without
bounding *ppos + count against size_buf.

vme_user_write()/vme_user_read() only clamp count to the VME window size
(image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the
user-supplied slave.size -- validated against the VME address space (up
to VME_A32_MAX = 4 GiB), not against PCI_BUF_SIZE.  When the window
exceeds 128 KiB, a write()/read() copies past the kern_buf allocation.

Clamp count against size_buf in both helpers, with an early return when
*ppos is already at/after the buffer end.  *ppos is >= 0 here (the caller
rejects negative offsets), so size_buf - *ppos cannot wrap.  This mirrors
the existing clamp in the MASTER-path helpers resource_to_user() /
resource_from_user(), and matches the read()/write() convention of a
short transfer at end-of-buffer.

Found by static analysis (CodeQL taint tracking + CBMC bounded model
checking) and confirmed dynamically under KASAN with the vme_fake bridge:

  BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x2d/0x80
  Write of size 262144 at addr ffff888004100000 by task trigger/68
    _copy_from_user+0x2d/0x80
    vme_user_write+0x13e/0x240 [vme_user]
    vfs_write+0x1b8/0x7a0
    ksys_write+0xb8/0x150

The Linux kernel CVE team has assigned CVE-2026-64449 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 2.6.32 with commit f00a86d98a1ec3e99d352cda926fab767ba43b1f and fixed in 6.1.178 with commit 65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed
	Issue introduced in 2.6.32 with commit f00a86d98a1ec3e99d352cda926fab767ba43b1f and fixed in 6.6.145 with commit adc8b9c30d716c362646edb45662aa1c641a154a
	Issue introduced in 2.6.32 with commit f00a86d98a1ec3e99d352cda926fab767ba43b1f and fixed in 6.12.96 with commit 8eff7cd4817e14dbe3b9952cce55ef52d1d38940
	Issue introduced in 2.6.32 with commit f00a86d98a1ec3e99d352cda926fab767ba43b1f and fixed in 6.18.39 with commit e99f2df433c63c86c93de1e5f08f16e404388756
	Issue introduced in 2.6.32 with commit f00a86d98a1ec3e99d352cda926fab767ba43b1f and fixed in 7.1.4 with commit 1b495fa0d4927c88d88bf346bf311f2e26e860ed
	Issue introduced in 2.6.32 with commit f00a86d98a1ec3e99d352cda926fab767ba43b1f and fixed in 7.2-rc3 with commit 9f32f38265014fac7f5dc9490fb01a638ce6e121

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64449
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/staging/vme_user/vme_user.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed
	https://git.kernel.org/stable/c/adc8b9c30d716c362646edb45662aa1c641a154a
	https://git.kernel.org/stable/c/8eff7cd4817e14dbe3b9952cce55ef52d1d38940
	https://git.kernel.org/stable/c/e99f2df433c63c86c93de1e5f08f16e404388756
	https://git.kernel.org/stable/c/1b495fa0d4927c88d88bf346bf311f2e26e860ed
	https://git.kernel.org/stable/c/9f32f38265014fac7f5dc9490fb01a638ce6e121