CVE-2026-64254
Received Received - Intake

Memory Leak in Linux Kernel NTB EPF Driver

Publication date: 2026-07-24

Last updated on: 2026-07-24

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR When BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, the module teardown path ends up calling pci_iounmap() on the same iomem with some offset, which is unnecessary and triggers a kernel warning like the following: Trying to vunmap() nonexistent vm area (0000000069a5ffe8) WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937 [...] Call trace: vunmap+0x58/0x68 (P) iounmap+0x34/0x48 pci_iounmap+0x2c/0x40 ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf] pci_device_remove+0x48/0xf8 device_remove+0x50/0x88 device_release_driver_internal+0x1c8/0x228 driver_detach+0x50/0xb0 bus_remove_driver+0x74/0x100 driver_unregister+0x34/0x68 pci_unregister_driver+0x34/0xa0 ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf] [...] Fix it by unmapping only when PEER_SPAD and CONFIG use difference bars.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-24
Last Modified
2026-07-24
Generated
2026-07-24
AI Q&A
2026-07-24
EPSS Evaluated
N/A
NVD
CVE-2026-64254
EUVD
EUVD-2026-48663

Affected Vendors & Products

Currently, no data is known.

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a module teardown issue where pci_iounmap() is called with an offset when BAR_PEER_SPAD and BAR_CONFIG share the same PCI BAR. This triggers a kernel warning about attempting to unmap a non-existent memory area.

Detection Guidance

This vulnerability is specific to the Linux kernel's NTB (Non-Transparent Bridge) subsystem, particularly the ntb_hw_epf module. Detection involves checking for kernel warnings related to vunmap() or iounmap() during module unloading. Monitor kernel logs for messages like 'Trying to vunmap() nonexistent vm area' or warnings from mm/vmalloc.c during driver removal.

Impact Analysis

This vulnerability may cause kernel warnings during module removal, potentially leading to system instability or unexpected behavior when the affected module is unloaded.

Compliance Impact

This vulnerability does not directly affect compliance with standards like GDPR or HIPAA as it is a kernel-level memory management issue in the Linux NTB subsystem. It may indirectly impact compliance if the kernel warning causes system instability or crashes, potentially affecting data integrity or availability.

Mitigation Strategies

Apply the kernel patch that fixes the issue by ensuring pci_iounmap() is only called when PEER_SPAD and CONFIG use different BARs. Update to a patched kernel version where this issue is resolved. Avoid unloading and reloading the ntb_hw_epf module unnecessarily.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64254. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart