partitions: aix: bound the pp_count scan to the ppe array

...

UBUNTU-CVE-2026-64318

In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the ppcount scan to the ppe array aixpartition reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array: int numpps = be16tocpupvd-ppcount; ... fo...

EUVD-2026-49030

In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the ppcount scan to the ppe array aixpartition reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array: int numpps = be16tocpupvd-ppcount; ... fo...

CVE-2026-64318

In the Linux kernel, the following vulnerability has been resolved: partitions: aix: bound the ppcount scan to the ppe array aixpartition reads the physical volume descriptor into a fixed-size struct pvd and then scans its physical-partition-extent array: int numpps = be16tocpupvd-ppcount; ... fo...

CVE-2026-64318

Summary (CVE-2026-64318) : In the Linux kernel, the partitions code for AIX on the PPC/IBM layout could read past the end of the ppe[] array. The function aix_partition() loads a fixed-size pvd and iterates up to the on-disk pp_count, which could exceed the allocated 1016 entries, leading to pote...