CVE-2026-64318 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
partitions: aix: bound the pp_count scan to the ppe array
aix_partition() reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array:
int numpps = be16_to_cpu(pvd->pp_count); ... for (i = 0; i < numpps; i += 1) {
struct ppe *p = pvd->ppe + i; ... lp_ix = be16_to_cpu(p->lp_ix);
pvd points at a single kmalloc()'d struct pvd whose ppe[] member holds a
fixed ARRAY_SIZE(pvd->ppe) (1016) entries, but the loop runs up to the on-disk pp_count. pp_count is an unvalidated __be16 read straight from the descriptor, so a crafted AIX image with pp_count larger than 1016 drives the loop to read pvd->ppe[i] past the end of the allocation (up
to 65535 entries, ~2 MB out of bounds).
The partition scan runs without mounting anything, when a block device with a crafted AIX/IBM partition table appears (an attacker-supplied image attached with losetup -P, or a device auto-scanned by udev), via msdos_partition() -> aix_partition().
Clamp the scan to the number of entries the ppe[] array can hold.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/25/2026
The vulnerability in question involves a buffer overflow condition within the Linux kernel's AIX partition handling code that arises from inadequate bounds checking during the processing of physical volume descriptors. This flaw exists in the aix_partition() function which is responsible for parsing AIX partition tables and can be triggered when the kernel encounters a block device containing a maliciously crafted AIX image. The issue stems from the fundamental mismatch between the fixed-size array allocated for physical partition extents and the potentially unbounded count value read from disk.
The technical implementation of this vulnerability occurs when the kernel reads a physical volume descriptor structure that contains a fixed-size array of physical partition extents with a maximum capacity of 1016 entries. However, the code retrieves the actual number of partitions from an unvalidated 16-bit big-endian integer field within the descriptor without performing any bounds validation. This allows an attacker to specify a pp_count value that far exceeds the allocated array size, causing the loop to access memory beyond the legitimate boundaries of the kmalloc-allocated structure. The vulnerability specifically manifests when the kernel processes AIX partition tables through the msdos_partition() function which then invokes aix_partition(), creating a direct path for exploitation.
The operational impact of this vulnerability is significant as it can be exploited through simple means such as attaching a crafted image using losetup -P or by having udev automatically scan a malicious device. The attack does not require mounting any filesystems or elevated privileges, making it particularly dangerous for automated systems that process external storage devices. The out-of-bounds memory access can lead to kernel memory corruption which may result in system instability, denial of service conditions, or potentially privilege escalation depending on the specific memory layout and exploitation circumstances. This represents a classic buffer overflow vulnerability with potential for remote code execution in kernel space.
This vulnerability aligns with CWE-129 and CWE-787 categories from the Common Weakness Enumeration framework, specifically covering improper input validation and out-of-bounds read conditions. The flaw also maps to ATT&CK technique T1068 which involves exploiting vulnerabilities to gain elevated privileges, and T1499 which covers network denial of service through resource exhaustion. The mitigation strategy requires implementing proper bounds checking by clamping the partition scan count to the actual capacity of the ppe array rather than allowing the unvalidated pp_count value to drive the loop execution. This approach ensures that the memory access remains within the allocated bounds while preserving the legitimate functionality of the partition scanning code. The fix represents a straightforward defensive programming practice that prevents attackers from leveraging malformed input data to corrupt kernel memory structures and should be applied across all affected kernel versions to maintain system security integrity.