CVE-2026-64402 (GCVE-0-2026-64402)

Vulnerability from cvelistv5 – Published: 2026-07-25 08:50 – Updated: 2026-08-17 04:55
VLAI
Title
coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
Summary
In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() When the SMB sink is used as a perf AUX sink, smb_update_buffer() calls smb_sync_perf_buffer() to copy hardware trace data into the perf AUX ring buffer pages. It derives pg_idx = head >> PAGE_SHIFT from @head, which is handle->head, and indexes dst_pages[pg_idx]. The pg_idx %= nr_pages normalization is only applied after the first loop iteration. This leaves the initial page index underived from the buffer size, which can result in an out-of-bounds write past dst_pages[] when head exceeds the AUX buffer size. Normalize head modulo the AUX buffer size before deriving the page index and offset, mirroring tmc_etr_sync_perf_buffer().
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: 06f5c2926aaa0fba7f99678da6ef77cbbbda1441 , < 38dbc8db8341ccdf8e1e1a067453d33ad751864b (git)
Affected: 06f5c2926aaa0fba7f99678da6ef77cbbbda1441 , < 4c5a0a946373da99a80398289b28845b5ae40cd1 (git)
Affected: 06f5c2926aaa0fba7f99678da6ef77cbbbda1441 , < 661a019ac0413ecec9e5d1dfcc12fbca8e78d5fb (git)
Affected: 06f5c2926aaa0fba7f99678da6ef77cbbbda1441 , < daf6246ab988fc8bdc82ad7c8d0b1c182d11b15f (git)
Affected: 06f5c2926aaa0fba7f99678da6ef77cbbbda1441 , < 98495b5a4d77dd22e106f462b76e1093a55b29a7 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.3
Unaffected: 0 , < 6.3 (semver)
Unaffected: 6.6.145 , ≤ 6.6.* (semver)
Unaffected: 6.12.96 , ≤ 6.12.* (semver)
Unaffected: 6.18.39 , ≤ 6.18.* (semver)
Unaffected: 7.1.4 , ≤ 7.1.* (semver)
Unaffected: 7.2 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwtracing/coresight/ultrasoc-smb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "38dbc8db8341ccdf8e1e1a067453d33ad751864b",
              "status": "affected",
              "version": "06f5c2926aaa0fba7f99678da6ef77cbbbda1441",
              "versionType": "git"
            },
            {
              "lessThan": "4c5a0a946373da99a80398289b28845b5ae40cd1",
              "status": "affected",
              "version": "06f5c2926aaa0fba7f99678da6ef77cbbbda1441",
              "versionType": "git"
            },
            {
              "lessThan": "661a019ac0413ecec9e5d1dfcc12fbca8e78d5fb",
              "status": "affected",
              "version": "06f5c2926aaa0fba7f99678da6ef77cbbbda1441",
              "versionType": "git"
            },
            {
              "lessThan": "daf6246ab988fc8bdc82ad7c8d0b1c182d11b15f",
              "status": "affected",
              "version": "06f5c2926aaa0fba7f99678da6ef77cbbbda1441",
              "versionType": "git"
            },
            {
              "lessThan": "98495b5a4d77dd22e106f462b76e1093a55b29a7",
              "status": "affected",
              "version": "06f5c2926aaa0fba7f99678da6ef77cbbbda1441",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "drivers/hwtracing/coresight/ultrasoc-smb.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.3"
            },
            {
              "lessThan": "6.3",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.145",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.96",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.39",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.1.*",
              "status": "unaffected",
              "version": "7.1.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.2",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.6.145",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.12.96",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.39",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1.4",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.2",
                  "versionStartIncluding": "6.3",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()\n\nWhen the SMB sink is used as a perf AUX sink, smb_update_buffer() calls\nsmb_sync_perf_buffer() to copy hardware trace data into the perf AUX ring\nbuffer pages. It derives pg_idx = head \u003e\u003e PAGE_SHIFT from @head, which is\nhandle-\u003ehead, and indexes dst_pages[pg_idx]. The pg_idx %= nr_pages\nnormalization is only applied after the first loop iteration.\n\nThis leaves the initial page index underived from the buffer size, which\ncan result in an out-of-bounds write past dst_pages[] when head exceeds\nthe AUX buffer size.\n\nNormalize head modulo the AUX buffer size before deriving the page index\nand offset, mirroring tmc_etr_sync_perf_buffer()."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - The vulnerable path is reached locally through perf_event_open(), AUX-buffer mmap, and perf event scheduling or ioctls; it has no network or physical entry point.\nAC:L - An attacker can choose a small AUX buffer, advance aux_tail, and repeatedly stop and restart their own trace until the monotonically increasing head crosses the buffer size. No race or condition outside the attacker\u0027s control is required.\nPR:L - A self-targeted event with exclude_kernel=1 is available to an ordinary unprivileged user under the mainline default perf_event_paranoid setting, and selecting the SMB sink requires no privileged sysfs write.\nUI:N - The attacker creates, runs, consumes, and stops their own tracing event without any victim action.\nS:U - Exploitation compromises the host kernel within the same security authority and does not inherently cross a VM, IOMMU, or other separate security boundary.\nC:H - The out-of-range page-pointer lookup directs memcpy() through a pointer obtained from groomable adjacent kernel memory. Resulting kernel-memory corruption can plausibly enable control-flow hijacking and unrestricted disclosure.\nI:H - The attacker-influenced trace data is written through an invalid kernel pointer, providing exploitable memory corruption that can plausibly yield arbitrary kernel modification or code execution.\nA:H - An ungroomed invalid destination pointer can immediately cause a kernel oops or panic, and the attacker can trigger the path repeatedly."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-17T04:55:00.113Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/38dbc8db8341ccdf8e1e1a067453d33ad751864b"
        },
        {
          "url": "https://git.kernel.org/stable/c/4c5a0a946373da99a80398289b28845b5ae40cd1"
        },
        {
          "url": "https://git.kernel.org/stable/c/661a019ac0413ecec9e5d1dfcc12fbca8e78d5fb"
        },
        {
          "url": "https://git.kernel.org/stable/c/daf6246ab988fc8bdc82ad7c8d0b1c182d11b15f"
        },
        {
          "url": "https://git.kernel.org/stable/c/98495b5a4d77dd22e106f462b76e1093a55b29a7"
        }
      ],
      "title": "coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64402",
    "datePublished": "2026-07-25T08:50:45.075Z",
    "dateReserved": "2026-07-19T15:36:31.785Z",
    "dateUpdated": "2026-08-17T04:55:00.113Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64402",
      "date": "2026-09-21",
      "epss": "0.00129",
      "percentile": "0.02863"
    },
    "microsoft_vex": {
      "current_release_date": "2026-07-27T14:44:21.000Z",
      "cve": "CVE-2026-64402",
      "id": "msrc_CVE-2026-64402",
      "initial_release_date": "2026-07-26T01:01:57.000Z",
      "product_status:known_affected": "1",
      "source": "Microsoft CSAF VEX",
      "status": "final",
      "title": "coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()",
      "url": "https://msrc.microsoft.com/csaf/vex/2026/msrc_cve-2026-64402.json",
      "version": "2"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hwtracing/coresight/ultrasoc-smb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "38dbc8db8341ccdf8e1e1a067453d33ad751864b",
                    "status": "affected",
                    "version": "06f5c2926aaa0fba7f99678da6ef77cbbbda1441",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4c5a0a946373da99a80398289b28845b5ae40cd1",
                    "status": "affected",
                    "version": "06f5c2926aaa0fba7f99678da6ef77cbbbda1441",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "661a019ac0413ecec9e5d1dfcc12fbca8e78d5fb",
                    "status": "affected",
                    "version": "06f5c2926aaa0fba7f99678da6ef77cbbbda1441",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "daf6246ab988fc8bdc82ad7c8d0b1c182d11b15f",
                    "status": "affected",
                    "version": "06f5c2926aaa0fba7f99678da6ef77cbbbda1441",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "98495b5a4d77dd22e106f462b76e1093a55b29a7",
                    "status": "affected",
                    "version": "06f5c2926aaa0fba7f99678da6ef77cbbbda1441",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "drivers/hwtracing/coresight/ultrasoc-smb.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.3"
                  },
                  {
                    "lessThan": "6.3",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.6.*",
                    "status": "unaffected",
                    "version": "6.6.145",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.12.*",
                    "status": "unaffected",
                    "version": "6.12.96",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.39",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.1.*",
                    "status": "unaffected",
                    "version": "7.1.4",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.2",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "FFC8CB6D-729C-42F2-8BDB-05E9ACC289A4",
                    "versionEndExcluding": "6.6.145",
                    "versionStartIncluding": "6.3",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "38A8100E-2B1A-462F-AEE9-8901B870FEF2",
                    "versionEndExcluding": "6.12.96",
                    "versionStartIncluding": "6.7",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7",
                    "versionEndExcluding": "6.18.39",
                    "versionStartIncluding": "6.13",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42",
                    "versionEndExcluding": "7.1.4",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\ncoresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()\n\nWhen the SMB sink is used as a perf AUX sink, smb_update_buffer() calls\nsmb_sync_perf_buffer() to copy hardware trace data into the perf AUX ring\nbuffer pages. It derives pg_idx = head \u003e\u003e PAGE_SHIFT from @head, which is\nhandle-\u003ehead, and indexes dst_pages[pg_idx]. The pg_idx %= nr_pages\nnormalization is only applied after the first loop iteration.\n\nThis leaves the initial page index underived from the buffer size, which\ncan result in an out-of-bounds write past dst_pages[] when head exceeds\nthe AUX buffer size.\n\nNormalize head modulo the AUX buffer size before deriving the page index\nand offset, mirroring tmc_etr_sync_perf_buffer()."
          }
        ],
        "id": "CVE-2026-64402",
        "lastModified": "2026-09-04T14:45:56.780",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 7.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "UNCHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 1.8,
              "impactScore": 5.9,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-25T10:17:23.737",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/38dbc8db8341ccdf8e1e1a067453d33ad751864b"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4c5a0a946373da99a80398289b28845b5ae40cd1"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/661a019ac0413ecec9e5d1dfcc12fbca8e78d5fb"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/98495b5a4d77dd22e106f462b76e1093a55b29a7"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/daf6246ab988fc8bdc82ad7c8d0b1c182d11b15f"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-787"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "Moderate",
      "current_release_date": "2026-07-29T11:09:04+00:00",
      "cve": "CVE-2026-64402",
      "id": "CVE-2026-64402",
      "initial_release_date": "2026-07-25T00:00:00+00:00",
      "product_status:known_not_affected": "274",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64402.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-09-15T01:49:51Z",
      "cve": "CVE-2026-64402",
      "id": "CVE-2026-64402",
      "initial_release_date": "2026-07-25T16:00:01Z",
      "product_status:known_affected": "125",
      "product_status:known_not_affected": "251",
      "product_status:recommended": "4",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64402",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64402.json",
      "version": "6"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.