Description
In the Linux kernel, the following vulnerability has been resolved:

net: devmem: reject dma-buf bind with non-page-aligned size or SG length

net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be
PAGE_SIZE multiples without checking:

- tx_vec is sized dmabuf->size / PAGE_SIZE, and
net_devmem_get_niov_at() only bounds-checks virt_addr < dmabuf->size
before indexing tx_vec[virt_addr / PAGE_SIZE]. With size =
N*PAGE_SIZE + r (1 <= r < PAGE_SIZE), sendmsg() at iov_base =
N*PAGE_SIZE passes the bound check and reads tx_vec[N] -- one past.

- owner->area.num_niovs = len / PAGE_SIZE while gen_pool_add_owner()
covers the full byte len, so a non-page-multiple non-final sg
desyncs num_niovs from the gen_pool region for every later sg, on
both RX and TX.

dma-buf does not require page-aligned sizes, so the bind path has to
enforce what its own indexing assumes. Reject both with -EINVAL.

The size check is TX-only (only tx_vec is sized off dmabuf->size); the
SG-length check covers both directions.
Published: 2026-07-19
Score: 8.8 High
EPSS: < 1% Very Low
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

The vulnerability lies in the Linux kernel’s net_devmem_bind_dmabuf function, which incorrectly assumes that dma-buf sizes and scatter‑gather lengths are always multiples of PAGE_SIZE. When a non‑aligned size is supplied, the read of tx_vec[virt_addr / PAGE_SIZE] can reference memory beyond the allocated array, resulting in an out‑of‑bounds read that could expose kernel data or trigger a fault. This flaw is a classic example of CWE‑125.

Affected Systems

Every Linux kernel that includes the net:devmem subsystem and does not yet contain the patch is affected. Because no specific product version information is supplied, all kernels that included the pre‑patch code are potentially vulnerable.

Risk and Exploitability

With a CVSS score of 8.8 the vulnerability is classified as high severity. The EPSS indicates a very low exploitation probability (<1%) and it is not listed in CISA KEV. The likely attack vector is local; a process that can bind a dma‑buf—such as a vulnerable network driver or a user application that interfaces with net:devmem—can trigger the out‑of‑bounds read. The exploit requires the ability to provide a non‑aligned dmabuf size; privilege escalation is not strictly required, but kernel privilege is needed to influence the bind path.

Generated by OpenCVE AI on July 30, 2026 at 20:23 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Update the Linux kernel to a version that includes the fix for CVE-2026-64124.
  • Verify that any drivers or applications using the net:devmem subsystem do not pass a non‑page‑aligned dma‑buf size to the bind function; if possible, add bounds checks or enforce alignment.
  • Monitor system logs for out‑of‑bounds read errors or kernel crashes and test under load to confirm the issue is resolved before deployment.

Generated by OpenCVE AI on July 30, 2026 at 20:23 UTC.

Tracking

Sign in to view the affected projects.

Advisories
Source ID Title
Ubuntu USN Ubuntu USN USN-8593-1 Linux kernel vulnerabilities
Ubuntu USN Ubuntu USN USN-8603-1 Linux kernel (Azure) vulnerabilities
Ubuntu USN Ubuntu USN USN-8618-1 Linux kernel vulnerabilities
History

Mon, 20 Jul 2026 14:45:00 +0000

Type Values Removed Values Added
Metrics cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H'}

Mon, 20 Jul 2026 12:15:00 +0000

Type Values Removed Values Added
Weaknesses CWE-125
References

Sun, 19 Jul 2026 16:15:00 +0000

Type Values Removed Values Added
Description In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without checking: - tx_vec is sized dmabuf->size / PAGE_SIZE, and net_devmem_get_niov_at() only bounds-checks virt_addr < dmabuf->size before indexing tx_vec[virt_addr / PAGE_SIZE]. With size = N*PAGE_SIZE + r (1 <= r < PAGE_SIZE), sendmsg() at iov_base = N*PAGE_SIZE passes the bound check and reads tx_vec[N] -- one past. - owner->area.num_niovs = len / PAGE_SIZE while gen_pool_add_owner() covers the full byte len, so a non-page-multiple non-final sg desyncs num_niovs from the gen_pool region for every later sg, on both RX and TX. dma-buf does not require page-aligned sizes, so the bind path has to enforce what its own indexing assumes. Reject both with -EINVAL. The size check is TX-only (only tx_vec is sized off dmabuf->size); the SG-length check covers both directions.
Title net: devmem: reject dma-buf bind with non-page-aligned size or SG length
First Time appeared Linux
Linux linux Kernel
CPEs cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Vendors & Products Linux
Linux linux Kernel
References

Subscriptions

Linux Linux Kernel
cve-icon MITRE

Status: PUBLISHED

Assigner: Linux

Published:

Updated: 2026-08-05T12:39:30.822Z

Reserved: 2026-07-19T07:54:57.036Z

Link: CVE-2026-64124

cve-icon Vulnrichment

No data.

cve-icon NVD

No data.

cve-icon Redhat

Severity :

Publid Date: 2026-07-19T00:00:00Z

Links: CVE-2026-64124 - Bugzilla

cve-icon OpenCVE Enrichment

Updated: 2026-07-30T20:30:04Z

Weaknesses