CVE-2026-64124 (GCVE-0-2026-64124)

Vulnerability from cvelistv5 – Published: 2026-07-19 15:40 – Updated: 2026-08-05 12:39
VLAI
Title
net: devmem: reject dma-buf bind with non-page-aligned size or SG length
Summary
In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without checking: - tx_vec is sized dmabuf->size / PAGE_SIZE, and net_devmem_get_niov_at() only bounds-checks virt_addr < dmabuf->size before indexing tx_vec[virt_addr / PAGE_SIZE]. With size = N*PAGE_SIZE + r (1 <= r < PAGE_SIZE), sendmsg() at iov_base = N*PAGE_SIZE passes the bound check and reads tx_vec[N] -- one past. - owner->area.num_niovs = len / PAGE_SIZE while gen_pool_add_owner() covers the full byte len, so a non-page-multiple non-final sg desyncs num_niovs from the gen_pool region for every later sg, on both RX and TX. dma-buf does not require page-aligned sizes, so the bind path has to enforce what its own indexing assumes. Reject both with -EINVAL. The size check is TX-only (only tx_vec is sized off dmabuf->size); the SG-length check covers both directions.
Severity
8.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Assigner
References
Impacted products
Vendor Product Version CPE status
Linux Linux Affected: bd61848900bff597764238f3a8ec67c815cd316e , < 134c517dfa63203287b2aad6558017f42435a02e (git)
Affected: bd61848900bff597764238f3a8ec67c815cd316e , < d5008e4e4ee6b739256b796702a7d1aae1b5c3b4 (git)
Affected: bd61848900bff597764238f3a8ec67c815cd316e , < 4eb82ba543421e9e38cc14e4e82058b78850df50 (git)
guessed Create a notification for this product.
Linux Linux Affected: 6.16
Unaffected: 0 , < 6.16 (semver)
Unaffected: 6.18.35 , ≤ 6.18.* (semver)
Unaffected: 7.0.11 , ≤ 7.0.* (semver)
Unaffected: 7.1 , ≤ * (original_commit_for_fix)
guessed Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "net/core/devmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "134c517dfa63203287b2aad6558017f42435a02e",
              "status": "affected",
              "version": "bd61848900bff597764238f3a8ec67c815cd316e",
              "versionType": "git"
            },
            {
              "lessThan": "d5008e4e4ee6b739256b796702a7d1aae1b5c3b4",
              "status": "affected",
              "version": "bd61848900bff597764238f3a8ec67c815cd316e",
              "versionType": "git"
            },
            {
              "lessThan": "4eb82ba543421e9e38cc14e4e82058b78850df50",
              "status": "affected",
              "version": "bd61848900bff597764238f3a8ec67c815cd316e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "net/core/devmem.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "6.16"
            },
            {
              "lessThan": "6.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.35",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.0.*",
              "status": "unaffected",
              "version": "7.0.11",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.18.35",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.11",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "7.1",
                  "versionStartIncluding": "6.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: devmem: reject dma-buf bind with non-page-aligned size or SG length\n\nnet_devmem_bind_dmabuf() trusts dmabuf-\u003esize and sg_dma_len() to be\nPAGE_SIZE multiples without checking:\n\n  - tx_vec is sized dmabuf-\u003esize / PAGE_SIZE, and\n    net_devmem_get_niov_at() only bounds-checks virt_addr \u003c dmabuf-\u003esize\n    before indexing tx_vec[virt_addr / PAGE_SIZE]. With size =\n    N*PAGE_SIZE + r (1 \u003c= r \u003c PAGE_SIZE), sendmsg() at iov_base =\n    N*PAGE_SIZE passes the bound check and reads tx_vec[N] -- one past.\n\n  - owner-\u003earea.num_niovs = len / PAGE_SIZE while gen_pool_add_owner()\n    covers the full byte len, so a non-page-multiple non-final sg\n    desyncs num_niovs from the gen_pool region for every later sg, on\n    both RX and TX.\n\ndma-buf does not require page-aligned sizes, so the bind path has to\nenforce what its own indexing assumes. Reject both with -EINVAL.\n\nThe size check is TX-only (only tx_vec is sized off dmabuf-\u003esize); the\nSG-length check covers both directions."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Exploitation requires local syscalls\u2014NETLINK_GENERIC netdev bind operations and sendmsg/recvmsg on TCP sockets\u2014not remote packet delivery. Network traffic can trigger RX allocations only after a local bind with a malformed dmabuf.\nAC:L - The attacker fully controls dmabuf size/SG layout at bind time and the virtual offset passed via sendmsg iovec bases, allowing reliable out-of-bounds indexing without races or victim-dependent timing.\nPR:L - TX bind intentionally lacks admin-perm; RX bind requires CAP_NET_ADMIN, which is obtainable in user namespaces via unshare. No real-root privileges are needed, only a local authorized user on a devmem-capable system.\nUI:N - No victim interaction is required; the attacker triggers the bug through their own netlink bind and socket operations.\nS:C - Corrupted net_iov metadata can program incorrect DMA addresses for NIC DMA operations, potentially impacting device memory outside the kernel\u0027s security authority\u2014a DMA boundary crossing inherent to the devmem subsystem.\nC:H - Out-of-bounds read of tx_vec leaks adjacent kernel heap contents (kernel pointers), and heap corruption from misindexed niovs arrays can be leveraged for arbitrary memory disclosure.\nI:H - Out-of-bounds writes to the niovs array corrupt adjacent kernel heap objects, and use of attacker-influenced pointers in skb fragment setup enables memory corruption exploitable for control-flow hijacking.\nA:H - Dereferencing corrupted net_iov pointers or corrupting heap metadata via out-of-bounds access can cause kernel oops, panic, or hang during TX sendmsg or RX packet processing."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T12:39:30.822Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/134c517dfa63203287b2aad6558017f42435a02e"
        },
        {
          "url": "https://git.kernel.org/stable/c/d5008e4e4ee6b739256b796702a7d1aae1b5c3b4"
        },
        {
          "url": "https://git.kernel.org/stable/c/4eb82ba543421e9e38cc14e4e82058b78850df50"
        }
      ],
      "title": "net: devmem: reject dma-buf bind with non-page-aligned size or SG length",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2026-64124",
    "datePublished": "2026-07-19T15:40:21.879Z",
    "dateReserved": "2026-07-19T07:54:57.036Z",
    "dateUpdated": "2026-08-05T12:39:30.822Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-64124",
      "date": "2026-09-20",
      "epss": "0.00127",
      "percentile": "0.02734"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "defaultStatus": "unaffected",
                "product": "Linux",
                "programFiles": [
                  "net/core/devmem.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "lessThan": "134c517dfa63203287b2aad6558017f42435a02e",
                    "status": "affected",
                    "version": "bd61848900bff597764238f3a8ec67c815cd316e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "d5008e4e4ee6b739256b796702a7d1aae1b5c3b4",
                    "status": "affected",
                    "version": "bd61848900bff597764238f3a8ec67c815cd316e",
                    "versionType": "git"
                  },
                  {
                    "lessThan": "4eb82ba543421e9e38cc14e4e82058b78850df50",
                    "status": "affected",
                    "version": "bd61848900bff597764238f3a8ec67c815cd316e",
                    "versionType": "git"
                  }
                ]
              },
              {
                "defaultStatus": "affected",
                "product": "Linux",
                "programFiles": [
                  "net/core/devmem.c"
                ],
                "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
                "vendor": "Linux",
                "versions": [
                  {
                    "status": "affected",
                    "version": "6.16"
                  },
                  {
                    "lessThan": "6.16",
                    "status": "unaffected",
                    "version": "0",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "6.18.*",
                    "status": "unaffected",
                    "version": "6.18.35",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "7.0.*",
                    "status": "unaffected",
                    "version": "7.0.11",
                    "versionType": "semver"
                  },
                  {
                    "lessThanOrEqual": "*",
                    "status": "unaffected",
                    "version": "7.1",
                    "versionType": "original_commit_for_fix"
                  }
                ]
              }
            ],
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
          }
        ],
        "configurations": [
          {
            "nodes": [
              {
                "cpeMatch": [
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "7BC83D47-7720-40AC-85ED-873326493894",
                    "versionEndExcluding": "6.18.35",
                    "versionStartIncluding": "6.16",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                    "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750",
                    "versionEndExcluding": "7.0.11",
                    "versionStartIncluding": "6.19",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                    "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                    "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                    "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                    "vulnerable": true
                  },
                  {
                    "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc4:*:*:*:*:*:*",
                    "matchCriteriaId": "E5910A9D-F60A-409A-B486-FE66BFEBA9B9",
                    "vulnerable": true
                  }
                ],
                "negate": false,
                "operator": "OR"
              }
            ]
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: devmem: reject dma-buf bind with non-page-aligned size or SG length\n\nnet_devmem_bind_dmabuf() trusts dmabuf-\u003esize and sg_dma_len() to be\nPAGE_SIZE multiples without checking:\n\n  - tx_vec is sized dmabuf-\u003esize / PAGE_SIZE, and\n    net_devmem_get_niov_at() only bounds-checks virt_addr \u003c dmabuf-\u003esize\n    before indexing tx_vec[virt_addr / PAGE_SIZE]. With size =\n    N*PAGE_SIZE + r (1 \u003c= r \u003c PAGE_SIZE), sendmsg() at iov_base =\n    N*PAGE_SIZE passes the bound check and reads tx_vec[N] -- one past.\n\n  - owner-\u003earea.num_niovs = len / PAGE_SIZE while gen_pool_add_owner()\n    covers the full byte len, so a non-page-multiple non-final sg\n    desyncs num_niovs from the gen_pool region for every later sg, on\n    both RX and TX.\n\ndma-buf does not require page-aligned sizes, so the bind path has to\nenforce what its own indexing assumes. Reject both with -EINVAL.\n\nThe size check is TX-only (only tx_vec is sized off dmabuf-\u003esize); the\nSG-length check covers both directions."
          }
        ],
        "id": "CVE-2026-64124",
        "lastModified": "2026-08-13T15:11:27.950",
        "metrics": {
          "cvssMetricV31": [
            {
              "cvssData": {
                "attackComplexity": "LOW",
                "attackVector": "LOCAL",
                "availabilityImpact": "HIGH",
                "baseScore": 8.8,
                "baseSeverity": "HIGH",
                "confidentialityImpact": "HIGH",
                "integrityImpact": "HIGH",
                "privilegesRequired": "LOW",
                "scope": "CHANGED",
                "userInteraction": "NONE",
                "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
                "version": "3.1"
              },
              "exploitabilityScore": 2.0,
              "impactScore": 6.0,
              "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
              "type": "Secondary"
            }
          ]
        },
        "published": "2026-07-19T16:17:54.030",
        "references": [
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/134c517dfa63203287b2aad6558017f42435a02e"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/4eb82ba543421e9e38cc14e4e82058b78850df50"
          },
          {
            "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
            "tags": [
              "Patch"
            ],
            "url": "https://git.kernel.org/stable/c/d5008e4e4ee6b739256b796702a7d1aae1b5c3b4"
          }
        ],
        "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "vulnStatus": "Analyzed",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "NVD-CWE-noinfo"
              }
            ],
            "source": "nvd@nist.gov",
            "type": "Primary"
          }
        ]
      }
    },
    "redhat_vex": {
      "aggregate_severity": "None",
      "current_release_date": "2026-07-21T08:04:35+00:00",
      "cve": "CVE-2026-64124",
      "id": "CVE-2026-64124",
      "initial_release_date": "2026-07-19T00:00:00+00:00",
      "product_status:known_not_affected": "275",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: net: devmem: reject dma-buf bind with non-page-aligned size or SG length",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-64124.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-06T01:09:20Z",
      "cve": "CVE-2026-64124",
      "id": "CVE-2026-64124",
      "initial_release_date": "2026-07-21T12:59:15Z",
      "product_status:known_not_affected": "296",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2026-64124",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-64124.json",
      "version": "3"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.