CVE-2026-64318 (GCVE-0-2026-64318)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:49 – Updated: 2026-08-17 04:53
VLAI
Title
partitions: aix: bound the pp_count scan to the ppe array
Summary
In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the pp_count scan to the ppe array aix_partition() reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array: int numpps = be16_to_cpu(pvd->pp_count); ... for (i = 0; i < numpps; i += 1) { struct ppe *p = pvd->ppe + i; ... lp_ix = be16_to_cpu(p->lp_ix); pvd points at a single kmalloc()'d struct pvd whose ppe[] member holds a fixed ARRAY_SIZE(pvd->ppe) (1016) entries, but the loop runs up to the on-disk pp_count. pp_count is an unvalidated __be16 read straight from the descriptor, so a crafted AIX image with pp_count larger than 1016 drives the loop to read pvd->ppe[i] past the end of the allocation (up to 65535 entries, ~2 MB out of bounds). The partition scan runs without mounting anything, when a block device with a crafted AIX/IBM partition table appears (an attacker-supplied image attached with losetup -P, or a device auto-scanned by udev), via msdos_partition() -> aix_partition(). Clamp the scan to the number of entries the ppe[] array can hold.
Severity
7.1 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < 09861651617ba0fec089e8b9477439e68398c110 (git)
Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < 5eacdb1967378f5e5591cd27a2d8cdee2df1a599 (git)
Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < b5e9c09309e18fd9839ad007c238120353ca0cc4 (git)
Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < fd94a779020f2ecc8b2607f4c20b34acb1763b9a (git)
Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < 4671bb74bba05fdd4acf670a35758c29e8c97b83 (git)
Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < ce93228e2193a17d2c58b656e439bb39fe5c3af8 (git)
Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < 44f37ee92fdcd377c41bdf6a31cdd8cc7d4c410e (git)
Affected: 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 , < 2dc0bfd2fe355fb930de63c2f2eb8ced8570c579 (git)
guessed Create a notification for this product.
Linux Linux Affected: 3.11
Unaffected: 0 , < 3.11 (semver)
Unaffected: 5.10.261 , ≤ 5.10.* (semver)
Unaffected: 5.15.212 , ≤ 5.15.* (semver)
Unaffected: 6.1.178 , ≤ 6.1.* (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "block/partitions/aix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "09861651617ba0fec089e8b9477439e68398c110",
              "status": "affected",
              "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
              "versionType": "git"
            },
            {
              "lessThan": "5eacdb1967378f5e5591cd27a2d8cdee2df1a599",
              "status": "affected",
              "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
              "versionType": "git"
            },
            {
              "lessThan": "b5e9c09309e18fd9839ad007c238120353ca0cc4",
              "status": "affected",
              "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
              "versionType": "git"
            },
            {
              "lessThan": "fd94a779020f2ecc8b2607f4c20b34acb1763b9a",
              "status": "affected",
              "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
              "versionType": "git"
            },
            {
              "lessThan": "4671bb74bba05fdd4acf670a35758c29e8c97b83",
              "status": "affected",
              "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
              "versionType": "git"
            },
            {
              "lessThan": "ce93228e2193a17d2c58b656e439bb39fe5c3af8",
              "status": "affected",
              "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
              "versionType": "git"
            },
            {
              "lessThan": "44f37ee92fdcd377c41bdf6a31cdd8cc7d4c410e",
              "status": "affected",
              "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
              "versionType": "git"
            },
            {
              "lessThan": "2dc0bfd2fe355fb930de63c2f2eb8ced8570c579",
              "status": "affected",
              "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "block/partitions/aix.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.11"
            },
            {
              "lessThan": "3.11",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.261",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.212",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.178",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.261",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.212",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.1.178",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "3.11",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npartitions: aix: bound the pp_count scan to the ppe array\n\naix_partition() reads the physical volume descriptor into a fixed-size\nstruct pvd and then scans its physical-partition-extent array:\n\n\tint numpps = be16_to_cpu(pvd-\u003epp_count);\n\t...\n\tfor (i = 0; i \u003c numpps; i += 1) {\n\t\tstruct ppe *p = pvd-\u003eppe + i;\n\t\t...\n\t\tlp_ix = be16_to_cpu(p-\u003elp_ix);\n\npvd points at a single kmalloc()\u0027d struct pvd whose ppe[] member holds a\nfixed ARRAY_SIZE(pvd-\u003eppe) (1016) entries, but the loop runs up to the\non-disk pp_count.  pp_count is an unvalidated __be16 read straight from\nthe descriptor, so a crafted AIX image with pp_count larger than 1016\ndrives the loop to read pvd-\u003eppe[i] past the end of the allocation (up\nto 65535 entries, ~2 MB out of bounds).\n\nThe partition scan runs without mounting anything, when a block device\nwith a crafted AIX/IBM partition table appears (an attacker-supplied\nimage attached with losetup -P, or a device auto-scanned by udev), via\nmsdos_partition() -\u003e aix_partition().\n\nClamp the scan to the number of entries the ppe[] array can hold."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - An attacker with local code execution can supply a crafted image through an unprivileged UDisks loop-setup operation with partition scanning enabled. No network protocol directly invokes this parser.\nAC:L - On an affected build, attacker-controlled on-disk fields deterministically reach the oversized scan without a race or memory-layout requirement for triggering the out-of-bounds access.\nPR:L - A basic active desktop user can request loop setup through UDisks under its default policy, while the kernel loop configuration path itself has no capability check. Initial-namespace root is not required in this deployment.\nUI:N - The attacker can initiate loop setup and partition scanning directly, without requiring another user to mount or open the image.\nS:U - The vulnerable partition parser and the affected kernel memory belong to the same operating-system security authority, with no demonstrated VM, IOMMU, or sandbox boundary crossing.\nC:H - The attacker-controlled count can cause 16-bit reads across nearly 2 MiB beyond the approximately 32 KiB allocation, sampling unrelated kernel memory. This is substantially more than a small bounded disclosure.\nI:N - The faulty accesses are reads; the derived logical-volume index is range-checked, and subsequent writes remain within the allocated lvip and partition-state arrays. No out-of-bounds write or control-flow write primitive is present.\nA:H - The slab out-of-bounds access is KASAN-confirmed and can produce an oops or panic on hardened kernels or when the traversal reaches inaccessible memory. An attacker can repeat partition scans to sustain denial of service."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:53:18.783Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/09861651617ba0fec089e8b9477439e68398c110"
        },
        {
          "url": "https://git.kernel.org/stable/c/5eacdb1967378f5e5591cd27a2d8cdee2df1a599"
        },
        {
          "url": "https://git.kernel.org/stable/c/b5e9c09309e18fd9839ad007c238120353ca0cc4"
        },
        {
          "url": "https://git.kernel.org/stable/c/fd94a779020f2ecc8b2607f4c20b34acb1763b9a"
        },
        {
          "url": "https://git.kernel.org/stable/c/4671bb74bba05fdd4acf670a35758c29e8c97b83"
        },
        {
          "url": "https://git.kernel.org/stable/c/ce93228e2193a17d2c58b656e439bb39fe5c3af8"
        },
        {
          "url": "https://git.kernel.org/stable/c/44f37ee92fdcd377c41bdf6a31cdd8cc7d4c410e"
        },
        {
          "url": "https://git.kernel.org/stable/c/2dc0bfd2fe355fb930de63c2f2eb8ced8570c579"
        }
      ],
      "title": "partitions: aix: bound the pp_count scan to the ppe array",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64318",
    "datePublished": "2026-07-25T08:49:47.690Z",
    "dateReserved": "2026-07-19T15:36:31.779Z",
    "dateUpdated": "2026-08-17T04:53:18.783Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64318",
      "date": "2026-09-20",
      "epss": "0.00164",
      "percentile": "0.06053"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:46:44.000Z",
      "cve": "CVE-2026-64318",
      "id": "msrc_CVE-2026-64318",
      "initial_release_date": "2026-07-26T01:04:23.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "partitions: aix: bound the pp_count scan to the ppe array",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64318.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "block/partitions/aix.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "09861651617ba0fec089e8b9477439e68398c110",
                    "status": "affected",
                    "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "5eacdb1967378f5e5591cd27a2d8cdee2df1a599",
                    "status": "affected",
                    "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "b5e9c09309e18fd9839ad007c238120353ca0cc4",
                    "status": "affected",
                    "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "fd94a779020f2ecc8b2607f4c20b34acb1763b9a",
                    "status": "affected",
                    "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4671bb74bba05fdd4acf670a35758c29e8c97b83",
                    "status": "affected",
                    "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "ce93228e2193a17d2c58b656e439bb39fe5c3af8",
                    "status": "affected",
                    "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "44f37ee92fdcd377c41bdf6a31cdd8cc7d4c410e",
                    "status": "affected",
                    "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "2dc0bfd2fe355fb930de63c2f2eb8ced8570c579",
                    "status": "affected",
                    "version": "6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "block/partitions/aix.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "3.11"
                  },
                  {
                    "lessThan": "3.11",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.10.*",
                    "status": "unaffected",
                    "version": "5.10.261",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "5.15.*",
                    "status": "unaffected",
                    "version": "5.15.212",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.1.*",
                    "status": "unaffected",
                    "version": "6.1.178",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.96",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "285B857A-71AC-4E69-B551-23166032F2BD",
                    "versionEndExcluding": "5.10.261",
                    "versionStartIncluding": "3.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "8E99FB01-CD93-41AF-A653-3F450652B9A6",
                    "versionEndExcluding": "5.15.212",
                    "versionStartIncluding": "5.11",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "092233C7-F4E0-40C8-BD4D-A28FE50DFE20",
                    "versionEndExcluding": "6.1.178",
                    "versionStartIncluding": "5.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7046B092-F810-4440-ACE6-60218518EECE",
                    "versionEndExcluding": "6.6.145",
                    "versionStartIncluding": "6.2",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2",
                    "versionEndExcluding": "6.12.96",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
                    "versionEndExcluding": "6.18.39",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\npartitions: aix: bound the pp_count scan to the ppe array\n\naix_partition() reads the physical volume descriptor into a fixed-size\nstruct pvd and then scans its physical-partition-extent array:\n\n\tint numpps = be16_to_cpu(pvd-\u003epp_count);\n\t...\n\tfor (i = 0; i \u003c numpps; i += 1) {\n\t\tstruct ppe *p = pvd-\u003eppe + i;\n\t\t...\n\t\tlp_ix = be16_to_cpu(p-\u003elp_ix);\n\npvd points at a single kmalloc()\u0027d struct pvd whose ppe[] member holds a\nfixed ARRAY_SIZE(pvd-\u003eppe) (1016) entries, but the loop runs up to the\non-disk pp_count.  pp_count is an unvalidated __be16 read straight from\nthe descriptor, so a crafted AIX image with pp_count larger than 1016\ndrives the loop to read pvd-\u003eppe[i] past the end of the allocation (up\nto 65535 entries, ~2 MB out of bounds).\n\nThe partition scan runs without mounting anything, when a block device\nwith a crafted AIX/IBM partition table appears (an attacker-supplied\nimage attached with losetup -P, or a device auto-scanned by udev), via\nmsdos_partition() -\u003e aix_partition().\n\nClamp the scan to the number of entries the ppe[] array can hold."
          }
        ],
        "id": "CVE-2026-64318",
        "lastModified": "2026-09-03T15:49:23.270",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.1,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "NONE",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.2,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:13.147",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/09861651617ba0fec089e8b9477439e68398c110"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/2dc0bfd2fe355fb930de63c2f2eb8ced8570c579"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/44f37ee92fdcd377c41bdf6a31cdd8cc7d4c410e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4671bb74bba05fdd4acf670a35758c29e8c97b83"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/5eacdb1967378f5e5591cd27a2d8cdee2df1a599"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/b5e9c09309e18fd9839ad007c238120353ca0cc4"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/ce93228e2193a17d2c58b656e439bb39fe5c3af8"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/fd94a779020f2ecc8b2607f4c20b34acb1763b9a"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-29T08:35:35+00:00",
      "cve": "CVE-2026-64318",
      "id": "CVE-2026-64318",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: partitions: aix: bound the pp_count scan to the ppe array",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64318.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "important",
      "current_release_date": "2026-08-17T16:38:52Z",
      "cve": "CVE-2026-64318",
      "id": "CVE-2026-64318",
      "initial_release_date": "2026-07-25T16:45:50Z",
      "product_status:known_not_affected": "298",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64318",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64318.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.