CVE-2026-64124
Received Received - Intake

Heap-based Buffer Overflow in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-07-19

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without checking: - tx_vec is sized dmabuf->size / PAGE_SIZE, and net_devmem_get_niov_at() only bounds-checks virt_addr < dmabuf->size before indexing tx_vec[virt_addr / PAGE_SIZE]. With size = N*PAGE_SIZE + r (1 <= r < PAGE_SIZE), sendmsg() at iov_base = N*PAGE_SIZE passes the bound check and reads tx_vec[N] -- one past. - owner->area.num_niovs = len / PAGE_SIZE while gen_pool_add_owner() covers the full byte len, so a non-page-multiple non-final sg desyncs num_niovs from the gen_pool region for every later sg, on both RX and TX. dma-buf does not require page-aligned sizes, so the bind path has to enforce what its own indexing assumes. Reject both with -EINVAL. The size check is TX-only (only tx_vec is sized off dmabuf->size); the SG-length check covers both directions.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-19
Last Modified
2026-07-19
Generated
2026-07-20
AI Q&A
2026-07-19
EPSS Evaluated
N/A
NVD
CVE-2026-64124
EUVD
EUVD-2026-45809

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves improper handling of non-page-aligned sizes or scatter-gather (SG) lengths in the net_devmem_bind_dmabuf function. The function assumes dmabuf->size and sg_dma_len() are multiples of PAGE_SIZE but does not verify this, leading to potential out-of-bounds memory access when indexing arrays like tx_vec.

Detection Guidance

This vulnerability is specific to the Linux kernel's net_devmem_bind_dmabuf function and requires kernel-level inspection. Detection involves checking kernel logs for DMA-BUF binding errors or examining kernel source code for the affected function. No direct network commands detect this issue.

Impact Analysis

This vulnerability could allow an attacker to cause memory corruption or crashes by exploiting the out-of-bounds access. It may lead to denial-of-service conditions or potentially enable further exploitation if combined with other vulnerabilities.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level kernel memory handling issue that could potentially lead to memory corruption or out-of-bounds access in network device memory operations, but no evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the latest Linux kernel patches that address this issue. Avoid using DMA-BUF with non-page-aligned sizes or SG lengths in network operations. Monitor kernel logs for DMA-BUF binding failures as a potential indicator of exploitation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64124. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart