CVE-2026-64280

HighCVSS 8.8/10Last modified Aug 23, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()

afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is derived as length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes int nr_pages, causing implicit truncation if length is very large.

Validate map.length at the ioctl entry point before calling afu_dma_map_region(), rejecting values whose page count exceeds INT_MAX.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Affected software

VendorProductVersions
LinuxLinux>= fa8dda1edef9ebc3af467c644c5533ac97171e12, < 5352d488ce4ae5e8c68c080ad4c3a5f084ad5fbc; >= fa8dda1edef9ebc3af467c644c5533ac97171e12, < d7e787eee2ea619b6dbb98890472ee73daf2e7fd; >= fa8dda1edef9ebc3af467c644c5533ac97171e12, < a6a3884ff500f04f3088d6d09eec803cd35331a2; >= fa8dda1edef9ebc3af467c644c5533ac97171e12, < 16381bda90b261a656ded0568630c1b857b2ebc8; >= fa8dda1edef9ebc3af467c644c5533ac97171e12, < b50e6cd2395cde615f59b624819998d28c0668d6; >= fa8dda1edef9ebc3af467c644c5533ac97171e12, < 59070040fd12e0b78d7b4d341d9f9a183237c5ff; >= fa8dda1edef9ebc3af467c644c5533ac97171e12, < fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231; >= fa8dda1edef9ebc3af467c644c5533ac97171e12, < fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27
LinuxLinux4.19

References

Timeline

Published
Jul 25, 2026
Last modified
Aug 23, 2026
NVD status
Modified

Related CVEs from 2026

CVE-2026-642817.5In the Linux kernel, the following vulnerability has been resolved: svcrdma: wake sq waiters when the transport closes Threads parked in sCVE-2026-642824.7In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Don't leak PFN when kvm_translate_vncr() races MMU notifierCVE-2026-642837.0In the Linux kernel, the following vulnerability has been resolved: KVM: guest_memfd: Treat memslot binding offset+size as unsigned values CVE-2026-642847.1In the Linux kernel, the following vulnerability has been resolved: KVM: x86: Ensure vendor's exit handler runs before fastpath userspace eCVE-2026-642855.5In the Linux kernel, the following vulnerability has been resolved: KVM: SEV: Pin source page for write when adding CPUID data for SNP guesCVE-2026-642868.2In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Clear __hyp_running_vcpu when flushing the pKVM hyp vCPU fCVE-2026-642878.2In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: Bound used_lrs when flushing the pKVM hyp vCPU flush_hyp_vCVE-2026-642885.5In the Linux kernel, the following vulnerability has been resolved: KVM: arm64: nv: Avoid dereferencing NULL VNCR pseudo-TLB VNCR TLB invaCVE-2026-642895.5In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entry_num and entry_lenCVE-2026-64295.3When asked to both use a `.netrc` file for credentials and to follow HTTP redirects, libcurl could leak the password used for the first hostCVE-2026-642905.5In the Linux kernel, the following vulnerability has been resolved: iommufd: Break the loop on failure in iommufd_fault_fops_read() On a cCVE-2026-642915.5In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts
CVE-2026-64280: High severity, CVSS 8.8 | Vulnix