CVE-2026-64402

A flaw was found in the Linux kernel's coresight ultrasoc-smb component. This vulnerability involves an out-of-bounds write in the smb_sync_perf_buffer() function. An attacker could potentially exploit this by causing the system to write data beyond the intended memory buffer, which may lead to system instability or a denial of service (DoS). This occurs because a page index is calculated incorrectly before being properly normalized, allowing the system to access memory outside its allocated boundaries.

An out of bounds write exists in the CoreSight UltraSoc SMB perf AUX sink path because smb_sync_perf_buffer derives the first dst_pages index from handle head before normalizing it to the AUX ring buffer size. A local attacker with access to perf AUX tracing and the affected SMB sink may drive head beyond the AUX buffer size and cause the initial page index to address memory outside dst_pages. For the CVSS the PR:L is used because reliable triggering requires local access to perf or tracing interfaces, but not necessarily full administrator control in deployments where such access is delegated or available to low privileged users. The issue is not network reachable and depends on affected CoreSight hardware and driver use. Impact is at least local denial of service via kernel memory corruption and in the paranoid case may allow confidentiality and integrity impact or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.