CVE-2026-64449

HIGHPre-NVD 7.87.8—
EchelonGraph scoreMEDIUM confidence

This high-severity CVE scores 7.8 under a secondary CVSS source (NVD's own analysis pending). EPSS exploit probability: 0.2%, top 92% of all CVEs by exploit prediction. GitHub Security Advisory data not yet ingested — confidence will rise once GHSA publishes (typical lag: hours to days for open-source ecosystem CVEs; never for infrastructure-only CVEs).

Triggered by: NVD CVSS baseline
Sources: epss, secondary
Trending — 5 sources updated this week
7.8EG
EchelonGraph verdictPlan a fixSerious severity, but no confirmed exploitation yet.
  • High severity, but no confirmed exploitation yet
CISA-KEV: Not listedEPSS PROB: 0%CVSS: 7.8Exploit: None knownExposed: 0

No vendor fix yet — apply a workaround or compensating control (WAF / firewall / segmentation) and watch for a patch.

In the Linux kernel, the following vulnerability has been resolved:

staging: vme_user: bound slave read/write to the kern_buf size

The SLAVE-path helpers buffer_to_user() and buffer_from_user() copy 'count' bytes into/out of the fixed-size kern_buf (size_buf == PCI_BUF_SIZE == 0x20000, 128 KiB) using *ppos as the offset, without bounding *ppos + count against size_buf.

vme_user_write()/vme_user_read() only clamp count to the VME window size (image_size = vme_get_size(resource)), which VME_SET_SLAVE sets from the user-supplied slave.size -- validated against the VME address space (up to VME_A32_MAX = 4 GiB), not against PCI_BUF_SIZE. When the window exceeds 128 KiB, a write()/read() copies past the kern_buf allocation.

Clamp count against size_buf in both helpers, with an early return when *ppos is already at/after the buffer end. *ppos is >= 0 here (the caller rejects negative offsets), so size_buf - *ppos cannot wrap. This mirrors the existing clamp in the MASTER-path helpers resource_to_user() / resource_from_user(), and matches the read()/write() convention of a short transfer at end-of-buffer.

Found by static analysis (CodeQL taint tracking + CBMC bounded model checking) and confirmed dynamically under KASAN with the vme_fake bridge:

BUG: KASAN: slab-out-of-bounds in _copy_from_user+0x2d/0x80 Write of size 262144 at addr ffff888004100000 by task trigger/68 _copy_from_user+0x2d/0x80 vme_user_write+0x13e/0x240 [vme_user] vfs_write+0x1b8/0x7a0 ksys_write+0xb8/0x150

CVSS v3
7.8
EG Score
7.8(medium)
EG Risk
40(Track)
EG Risk 40/100SSVC: Track

EG Risk is EchelonGraph's 0–100 priority score: it fuses intrinsic severity with real-world exploitation and automatability so you can rank equal-severity CVEs and fix the most dangerous first. Higher = act sooner. Distinct from the 0–10 EG Score (severity).

How it’s computed
Severity78% × 45%
Exploitation0% × 40%
Automatability30% × 15%
Action: Routine — remediate on your standard cadence.
EPSS PROB
0%
EPSS %ILE
8%
KEV
Not listed

Published

July 25, 2026

Last Modified

July 27, 2026

Advisory Details (6)

Auto-updated Jul 27, 2026
No patch confirmed yet.
generic

staging: vme_user: bound slave read/write to the kern_buf size - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/e99f2df433c63c86c93de1e5f08f16e404388756
generic

staging: vme_user: bound slave read/write to the kern_buf size - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/adc8b9c30d716c362646edb45662aa1c641a154a
generic

staging: vme_user: bound slave read/write to the kern_buf size - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/9f32f38265014fac7f5dc9490fb01a638ce6e121
generic

staging: vme_user: bound slave read/write to the kern_buf size - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/8eff7cd4817e14dbe3b9952cce55ef52d1d38940
generic

staging: vme_user: bound slave read/write to the kern_buf size - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/65358d89dc9f1c25d9364b2b3ef0f3b47717f9ed
generic

staging: vme_user: bound slave read/write to the kern_buf size - kernel/git/stable/linux.git - Linux kernel stable tree

https://git.kernel.org/stable/c/1b495fa0d4927c88d88bf346bf311f2e26e860ed

Vendor Advisories for CVE-2026-64449(1)

These vendors published their own advisory mentioning this CVE — often with vendor-specific remediation steps + affected product lists not in NVD.

Data Freshness Timeline

(refreshed 14× in last 7d / 14× in last 30d)

Each row is a source pipeline that fetched or updated this CVE on that date, with what changed. For example, "NVD update" means NVD published or revised its analysis for this CVE; "MITRE cvelistV5" means we ingested or refreshed it from the CNA feed. Most recent first.

  1. 2026-07-27 05:26 UTCEG score recompute
  2. 2026-07-27 05:26 UTCGHSA enrichment
  3. 2026-07-27 05:13 UTCEG score recompute▲ 7.80
  4. 2026-07-27 05:13 UTCGHSA enrichment
  5. 2026-07-27 05:12 UTCMITRE cvelistV5CVSS v3 → 7.8 · severity → HIGH
  6. 2026-07-26 14:54 UTCEPSS rescore
  7. 2026-07-26 14:54 UTCEPSS rescore
  8. 2026-07-26 02:47 UTCEG score recompute
  9. 2026-07-26 02:47 UTCGHSA enrichment
  10. 2026-07-25 14:18 UTCEPSS rescore
  11. 2026-07-25 14:18 UTCEPSS rescore
  12. 2026-07-25 10:39 UTCNVD update
  13. 2026-07-25 09:26 UTCEG score recompute
  14. 2026-07-25 09:21 UTCMITRE cvelistV5first tracked

Frequently asked(5)

What is CVE-2026-64449?
CVE-2026-64449 is a high vulnerability published on July 25, 2026. In the Linux kernel, the following vulnerability has been resolved: staging: vmeuser: bound slave read/write to the kernbuf size The SLAVE-path helpers buffertouser() and bufferfromuser() copy 'count' bytes into/out of the fixed-size kernbuf (sizebuf == PCIBUFSIZE == 0x20000, 128 KiB) using *ppos…
When was CVE-2026-64449 disclosed?
CVE-2026-64449 was first published in the National Vulnerability Database on July 25, 2026, with the most recent update on July 27, 2026. EchelonGraph re-ingests CVE updates from NVD on a 2-hour cycle, so this page reflects the latest published state.
Is CVE-2026-64449 actively exploited?
CVE-2026-64449 is not currently on CISA's Known Exploited Vulnerabilities catalog. FIRST EPSS estimates a 0% probability of exploitation in the next 30 days, which ranks it in the top 92.1% of all scored CVEs.
What is the CVSS score of CVE-2026-64449?
CVE-2026-64449 has a CVSS v3 base score of 7.8 (NVD).
How do I remediate CVE-2026-64449?
Patch to the fixed version published by the affected vendor. Where vendor advisories exist for CVE-2026-64449, EchelonGraph cross-links them in the Vendor Advisories panel below — those typically contain the canonical remediation steps, fixed version numbers, and any vendor-specific mitigations.

Dependency Blast Radius

Explore the affected products and dependency analysis for CVE-2026-64449

Explore →

Is Your Infrastructure Affected by CVE-2026-64449?

EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.

Start Free Scan →Browse All CVEs