An out-of-bounds memory access vulnerability in the Linux kernel staging VME user driver allows local authenticated attackers to achieve complete system compromise.

This is a buffer overflow vulnerability involving the vme_user staging driver helper functions, requiring low local privileges and no user interaction to execute.

A successful exploit permits local users to execute arbitrary code with elevated privileges, resulting in total confidentiality, integrity, and availability loss of the host operating system. The CVSS score of 7.8 reflects the high severity of the potential impact, though the local attack vector slightly mitigates the overall exposure compared to network-based flaws.

Immediate Action: Update the Linux kernel to version 6.1.178, 6.6.145, 6.12.96, 6.18.39, or later depending on the active release branch.

Proactive Monitoring: Monitor system audit logs for abnormal kernel crashes, segmentation faults, or unauthorized access attempts to local VME device nodes.

Compensating Controls: Restrict local shell access and apply strict file permission controls on VME device files to prevent unauthorized interaction by unprivileged users.

Public Exploit Available: false

Administrators must prioritize updating affected Linux kernel packages to the patched versions as part of standard maintenance cycles. Applying these kernel updates promptly neutralizes the vector for local privilege escalation and protects underlying system integrity.