Linux EUVD-2026-49030

We are tasked with synthesizing data from multiple sources about CVE-2026-64318 into a comprehensive analysis, returning a JSON object with specified fields. Let's carefully parse the provided information.

CVE-2026-64318: In the Linux kernel, a vulnerability in the AIX partition handling. The description: "aix_partition() reads the physical volume descriptor... pp_count is unvalidated, so a crafted AIX image with pp_count > 1016 drives an out-of-bounds read... bound the scan to array size."

From description:

• Product: Linux kernel, specifically the partition handling for AIX disks (block/partitions/aix.c). So product_name: "Linux Kernel".
• CVSS Score: 7.1, Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
• CWE: N/A
• EPSS: 0.22% (percentile 13%)
• Patch: Available from vendor
• Tags: Linux, IBM, Information Disclosure
• KEV status: not mentioned (likely not KEV). POC? Not mentioned. So no active exploitation or public exploit identified from data.
• CPE: cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:* (but note: Linux kernel is typically "o:linux:linux_kernel", but given as "a" application? The data says "cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*". We'll use it as is, but product_name Linux kernel is correct.)
• Affected versions: We have a list of git commit ranges and patches. We can extract the fix versions: mention specific stable versions patched: 7.1.4, 6.18.39, 5.15.212, 5.10.261, 7.2-rc1, 6.6.145, 6.12.96, 6.1.178, and the initial commit from 3.11. So the vulnerability was introduced long ago (Linux 3.11) and fixed in multiple stable branches. The description mentions "Linux 6ceea22bbbc84fcf6bf0913bb3db8a657e9002f6 < ..." which is the commit that fixed it? Possibly the fix commit. The EUVD entries give commit ranges where the vulnerability exists. We'll synthesize: Affected: Linux kernel versions from 3.11 up to before the fix in the 5.10, 5.15, 6.1, 6.6, 6.12, 6.18, 7.1, 7.2 series. So we can say "Linux kernel versions prior to the patched releases: 5.10.261, 5.1