coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer()
Summary
| CVE | CVE-2026-64402 |
|---|---|
| State | PUBLISHED |
| Assigner | Linux |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2026-07-25 10:17:23 UTC |
| Updated | 2026-07-27 05:16:47 UTC |
| Description | In the Linux kernel, the following vulnerability has been resolved: coresight: ultrasoc-smb: Fix OOB write in smb_sync_perf_buffer() When the SMB sink is used as a perf AUX sink, smb_update_buffer() calls smb_sync_perf_buffer() to copy hardware trace data into the perf AUX ring buffer pages. It derives pg_idx = head >> PAGE_SHIFT from @head, which is handle->head, and indexes dst_pages[pg_idx]. The pg_idx %= nr_pages normalization is only applied after the first loop iteration. This leaves the initial page index underived from the buffer size, which can result in an out-of-bounds write past dst_pages[] when head exceeds the AUX buffer size. Normalize head modulo the AUX buffer size before deriving the page index and offset, mirroring tmc_etr_sync_perf_buffer(). |
Risk And Classification
Primary CVSS: v3.1 7.8 HIGH from 416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS: 0.001290000 probability, percentile 0.028920000 (date 2026-07-27)
| Version | Source | Type | Score | Severity | Vector |
|---|---|---|---|---|---|
| 3.1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | Secondary | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
| 3.1 | CNA | DECLARED | 7.8 | HIGH | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
CVSS v3.1 Breakdown
Attack Vector
LocalAttack Complexity
LowPrivileges Required
LowUser Interaction
NoneScope
UnchangedConfidentiality
HighIntegrity
HighAvailability
HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Vendor Declared Affected Products
| Source | Vendor | Product | Version | Platforms |
|---|---|---|---|---|
| CNA | Linux | Linux | affected 06f5c2926aaa0fba7f99678da6ef77cbbbda1441 38dbc8db8341ccdf8e1e1a067453d33ad751864b git | Not specified |
| CNA | Linux | Linux | affected 06f5c2926aaa0fba7f99678da6ef77cbbbda1441 4c5a0a946373da99a80398289b28845b5ae40cd1 git | Not specified |
| CNA | Linux | Linux | affected 06f5c2926aaa0fba7f99678da6ef77cbbbda1441 661a019ac0413ecec9e5d1dfcc12fbca8e78d5fb git | Not specified |
| CNA | Linux | Linux | affected 06f5c2926aaa0fba7f99678da6ef77cbbbda1441 daf6246ab988fc8bdc82ad7c8d0b1c182d11b15f git | Not specified |
| CNA | Linux | Linux | affected 06f5c2926aaa0fba7f99678da6ef77cbbbda1441 98495b5a4d77dd22e106f462b76e1093a55b29a7 git | Not specified |
| CNA | Linux | Linux | affected 6.3 | Not specified |
| CNA | Linux | Linux | unaffected 6.3 semver | Not specified |
| CNA | Linux | Linux | unaffected 6.6.145 6.6.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.12.96 6.12.* semver | Not specified |
| CNA | Linux | Linux | unaffected 6.18.39 6.18.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.1.4 7.1.* semver | Not specified |
| CNA | Linux | Linux | unaffected 7.2-rc1 * original_commit_for_fix | Not specified |
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| git.kernel.org/stable/c/661a019ac0413ecec9e5d1dfcc12fbca8e78d5fb | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/4c5a0a946373da99a80398289b28845b5ae40cd1 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/daf6246ab988fc8bdc82ad7c8d0b1c182d11b15f | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/38dbc8db8341ccdf8e1e1a067453d33ad751864b | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| git.kernel.org/stable/c/98495b5a4d77dd22e106f462b76e1093a55b29a7 | 416baaa9-dc9f-4396-8d5f-8c081fb06d67 | git.kernel.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.