CVE-2026-64232
Received Received - Intake

Kernel Integrity Segment Handling in Linux

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_segments in blk_insert_cloned_request blk_insert_cloned_request() already recomputes nr_phys_segments against the bottom queue, because "the queue settings related to segment counting may differ from the original queue." The exact same reasoning applies to integrity segments: a stacked driver's underlying queue can have tighter virt_boundary_mask, seg_boundary_mask, or max_segment_size than the top queue, in which case blk_rq_count_integrity_sg() against the bottom queue produces a different count than the cached rq->nr_integrity_segments inherited from the source request by blk_rq_prep_clone(). When the cached count is lower than the bottom queue's actual count, blk_rq_map_integrity_sg() trips BUG_ON(segments > rq->nr_integrity_segments); on dispatch. The same families of stacked setups that motivated the existing nr_phys_segments recompute -- dm-multipath fanning out to nvme-rdma in particular -- can produce this. Mirror the nr_phys_segments handling: when the request carries integrity, recompute nr_integrity_segments against the bottom queue and reject the request if it exceeds the bottom queue's max_integrity_segments. blk_rq_count_integrity_sg() and queue_max_integrity_segments() are both already available via <linux/blk-integrity.h>, which blk-mq.c includes. This closes a latent gap in the stacking contract and brings the integrity-segment accounting in line with the existing phys-segment accounting.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64232
EUVD
EUVD-2026-48640

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves incorrect handling of integrity segments in cloned block requests. When a request is cloned for stacked drivers like dm-multipath, the number of integrity segments may not be recomputed correctly for the underlying queue. This can lead to a mismatch between the cached segment count and the actual count required by the bottom queue, potentially causing a BUG_ON assertion failure during request dispatch.

Detection Guidance

This vulnerability is specific to the Linux kernel's block layer and may not have direct network detection methods. System administrators should check kernel logs for BUG_ON errors related to integrity segments or blk_insert_cloned_request failures. Monitor for crashes or I/O errors in stacked storage setups like dm-multipath.

Impact Analysis

This vulnerability could cause system crashes or instability in Linux systems using stacked block devices, such as those with dm-multipath configurations. It may lead to data corruption or denial of service if the BUG_ON condition is triggered during normal operation.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it pertains to a low-level Linux kernel block device integrity handling issue. No evidence suggests it impacts data protection, privacy, or security controls required by these regulations.

Mitigation Strategies

Apply the latest Linux kernel patches addressing this issue. For systems using dm-multipath or similar stacked drivers, verify integrity segment handling in kernel logs. Consider temporarily disabling integrity features if crashes occur until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64232. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart