CVE-2026-64217

Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source

AV:LAttack vector, local

The vulnerable helper is reached through local direct or unbuffered I/O against CIFS/SMB3, AFS, or 9P files. Remote peers cannot directly control the local user iterator that triggers extraction.

AC:LAttack complexity, low

The attacker controls and can repeatedly submit the UBUF or IOVEC layout, and corruption occurs synchronously once the overfill condition is reached. No race, timing window, or victim-controlled state is required.

PR:LPrivileges required, low

An ordinary unprivileged process with permission to access a file on an existing affected mount can reach the helper. No capability or administrative privilege is checked on the I/O path.

UI:NUser interaction, none

The attacker directly opens and performs I/O on the accessible file without requiring another user to act. An existing affected mount is a deployment prerequisite, not per-attack victim interaction.

S:UScope, unchanged

The corruption compromises the same host kernel that processes the local I/O. It does not inherently cross a VM, IOMMU, or other distinct security authority.

C:HConfidentiality impact, high

The overfill writes page pointers beyond the allocated kernel buffer and the malformed bvec can subsequently access unpopulated descriptors. Exploitation of this kernel heap corruption can expose arbitrary kernel memory.

I:HIntegrity impact, high

The bug produces an out-of-bounds kernel heap write and can cause adjacent memory to be interpreted as bvec descriptors. Heap grooming could turn this into arbitrary memory modification or control-flow hijacking.

A:HAvailability impact, high

The corruption can cause a kernel oops, panic, or hang, while aborted extraction can also leak pinned pages. An attacker can repeat the triggering I/O to sustain denial of service.