High 7.1Published Jul 25, 2026

CVE-2026-64318partitions: aix: bound the pp_count scan to the ppe array

Updated under an hour ago (Oct 28, 2026, 8:40 AM ET)

Does this affect you?

It affects Linux and 1 other product. Add what you run to find out whether that includes you.

No exploitation reported and no EPSS estimate yet.

Do this next

Start free and add your stack

Free account, 1 product

Every CVE for Linux

Exploited in the last 30 days

In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the pp_count scan to the ppe array aix_partition() reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array: int numpps = be16_to_cpu(pvd->pp_count); ... for (i = 0; i < numpps; i += 1) { struct ppe *p = pvd->ppe + i; ... lp_ix = be16_to_cpu(p->lp_ix); pvd points at a single kmalloc()'d struct pvd whose ppe[] member holds a fixed ARRAY_SIZE(pvd->ppe) (1016) entries, but the loop runs up to the on-disk pp_count. pp_count is an unvalidated __be16 read straight from the descriptor, so a crafted AIX image with pp_count larger than 1016 drives the loop to read pvd->ppe[i] past the end of the allocation (up to 65535 entries, ~2 MB out of bounds). The partition scan runs without mounting anything, when a block device with a crafted AIX/IBM partition table appears (an attacker-supplied image attached with losetup -P, or a device auto-scanned by udev), via msdos_partition() -> aix_partition(). Clamp the scan to the number of entries the ppe[] array can hold.

CVSS: 7.1 HIGH (v3.1, CNA)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
Weakness (CWE): Not given
Known exploited: Not in CISA's KEV catalog
EPSS (exploitation in the next 30 days): Not loaded for this CVE
Assigned by: Linux
NVD analysis: Analyzed
Record last updated: Aug 17, 2026
First seen by InfoSec Signals: Oct 9, 2026

Affected products

Affected products

Linux Linux linux:linux (from the name)	from 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 before 09861651617ba0fec089e8b9477439e68398c110; 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 builds before 5eacdb1967378f5e5591cd27a2d8cdee2df1a599; from 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 before b5e9c09309e18fd9839ad007c238120353ca0cc4; from 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 before fd94a779020f2ecc8b2607f4c20b34acb1763b9a; from 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 before 4671bb74bba05fdd4acf670a35758c29e8c97b83; from 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 before ce93228e2193a17d2c58b656e439bb39fe5c3af8; from 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 before 44f37ee92fdcd377c41bdf6a31cdd8cc7d4c410e; 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 builds before 2dc0bfd2fe355fb930de63c2f2eb8ced8570c579	CNA record
linux linux_kernel linux:linux_kernel	from 3.11 before 5.10.261; from 5.11 before 5.15.212; from 5.16 before 6.1.178; from 6.2 before 6.6.145; from 6.7 before 6.12.96; from 6.13 before 6.18.39; from 6.19 before 7.1.4	NVD

References

References

https://git.kernel.org/stable/c/09861651617ba0fec089e8b9477439e68398c110	patch
https://git.kernel.org/stable/c/5eacdb1967378f5e5591cd27a2d8cdee2df1a599	patch
https://git.kernel.org/stable/c/b5e9c09309e18fd9839ad007c238120353ca0cc4	patch
https://git.kernel.org/stable/c/fd94a779020f2ecc8b2607f4c20b34acb1763b9a	patch
https://git.kernel.org/stable/c/4671bb74bba05fdd4acf670a35758c29e8c97b83	patch
https://git.kernel.org/stable/c/ce93228e2193a17d2c58b656e439bb39fe5c3af8	patch
https://git.kernel.org/stable/c/44f37ee92fdcd377c41bdf6a31cdd8cc7d4c410e	patch
https://git.kernel.org/stable/c/2dc0bfd2fe355fb930de63c2f2eb8ced8570c579	patch

The CVE record on cve.org NVD's entry

The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.