CVE-2026-64254 - Vulnerability Details

- NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR

Description

In the Linux kernel, the following vulnerability has been resolved:

NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR

When BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, the module teardown
path ends up calling pci_iounmap() on the same iomem with some offset,
which is unnecessary and triggers a kernel warning like the following:

Trying to vunmap() nonexistent vm area (0000000069a5ffe8)
WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937
[...]
Call trace:
vunmap+0x58/0x68 (P)
iounmap+0x34/0x48
pci_iounmap+0x2c/0x40
ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf]
pci_device_remove+0x48/0xf8
device_remove+0x50/0x88
device_release_driver_internal+0x1c8/0x228
driver_detach+0x50/0xb0
bus_remove_driver+0x74/0x100
driver_unregister+0x34/0x68
pci_unregister_driver+0x34/0xa0
ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf]
[...]

Fix it by unmapping only when PEER_SPAD and CONFIG use difference bars.

Published: 2026-07-24

Score: 5.5 Medium

EPSS: < 1% Very Low

KEV: No

Impact:

Action:

Analysis

Impact

A flaw in the Linux kernel’s ntb epf driver, identified as CWE-617, causes the module teardown routine to call pci_iounmap() with an incorrect offset when the PEER_SPAD and CONFIG regions share the same PCI Base Address Register. This unchecked misuse triggers a warning that the kernel is trying to unmap a non‑existent virtual memory area. The impact is documented as a kernel warning.

Affected Systems

Any Linux kernel build that includes the ntb epf driver is affected. The driver is part of kernel versions that support non‑Transparent Bridge hardware, and any kernel prior to the resolution commit may be vulnerable.

Risk and Exploitability

The EPSS score is < 1 %, and the vulnerability is not listed in CISA’s KEV catalog, indicating a low likelihood of exploitation. The CVSS score of 5.5 reflects moderate severity, but the flaw only manifests during module teardown. The overall risk remains low, and the impact is limited to a kernel warning that can be monitored and addressed with a patch.

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor Product Default status Versions

Linux

unaffected

Version	Status	Constraints
`e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4`	affected	< eb47b9bffd07a47b84910847cb5ea066ce184055
`e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4`	affected	< 06f6dd2ff2bd07eaf7178a807407ff27e85122b4
`e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4`	affected	< a4be4a1308f02bff79a30eea2d04ead5b63685f2
`e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4`	affected	< 81371dbd23601f67f01372817fdbab42c5601e43
`e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4`	affected	< 9764a786ba98db58f0725913c369e721253aba33
`e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4`	affected	< d876153680e3d721d385e554def919bce3d18c74

Linux

affected

Version	Status	Constraints
`6.0`	affected	—
`0`	unaffected	< 6.0
`6.1.177`	unaffected	≤ 6.1.*
`6.6.144`	unaffected	≤ 6.6.*
`6.12.95`	unaffected	≤ 6.12.*
`6.18.38`	unaffected	≤ 6.18.*
`7.1.3`	unaffected	≤ 7.1.*
`7.2-rc1`	unaffected	≤ *

Configuration 1 [-]

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

No data.

Vendor Product Confidence Versions

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`[e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4,eb47b9bffd07a47b84910847cb5ea066ce184055)`	affected	code_commit	—
`[e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4,06f6dd2ff2bd07eaf7178a807407ff27e85122b4)`	affected	code_commit	—
`[e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4,a4be4a1308f02bff79a30eea2d04ead5b63685f2)`	affected	code_commit	—
`[e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4,81371dbd23601f67f01372817fdbab42c5601e43)`	affected	code_commit	—
`[e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4,9764a786ba98db58f0725913c369e721253aba33)`	affected	code_commit	—
`[e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4,d876153680e3d721d385e554def919bce3d18c74)`	affected	code_commit	—

Linux

Linux Kernel

99%

Version	Status	Scheme	Platform
`6.0`	affected	generic	—
`[0,6.0)`	unaffected	generic	—
`[6.1.177,6.2.0)`	unaffected	semver	—
`[6.6.144,6.7.0)`	unaffected	semver	—
`[6.12.95,6.13.0)`	unaffected	semver	—
`[6.18.38,6.19.0)`	unaffected	semver	—
`[7.1.3,7.2.0)`	unaffected	semver	—
`[7.2-rc1,*]`	unaffected	generic	—

Found an issue or want to improve our Enrichment? You can suggest it directly by opening an issue on our dedicated GitHub repository .

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

Update the Linux kernel to a release that contains the commit fixing the ntb epf driver bug.
If an immediate kernel update is not possible, unload the ntb epf module before shutdown or system reboot to avoid a teardown that triggers the fault.
Continuously monitor system logs for iounmap or vunmap warnings that indicate the unmap issue, and investigate any occurrences promptly.

Generated by OpenCVE AI on August 13, 2026 at 10:59 UTC.

Tracking

Sign in to view the affected projects.

Advisories

Source	ID	Title
Debian DLA	DLA-4700-1	linux-6.1 security update

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

The EPSS score is 0.00114.

Key SSVC decision points have not yet been added.

References

Link	Providers
https://git.kernel.org/stable/c/06f6dd2ff2bd07eaf7178a807407ff27e85122b4
https://git.kernel.org/stable/c/81371dbd23601f67f01372817fdbab42c5601e43
https://git.kernel.org/stable/c/9764a786ba98db58f0725913c369e721253aba33
https://git.kernel.org/stable/c/a4be4a1308f02bff79a30eea2d04ead5b63685f2
https://git.kernel.org/stable/c/d876153680e3d721d385e554def919bce3d18c74
https://git.kernel.org/stable/c/eb47b9bffd07a47b84910847cb5ea066ce184055
https://lore.kernel.org/linux-cve-announce/2026072420-CVE-2026-64254-0322@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2026-64254
https://www.cve.org/CVERecord?id=CVE-2026-64254

History

Wed, 12 Aug 2026 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-617

Sun, 02 Aug 2026 14:30:00 +0000

Type	Values Removed	Values Added
Weaknesses	CWE-703 CWE-725

Tue, 28 Jul 2026 16:15:00 +0000

Type	Values Removed	Values Added
References		https://lore.kernel.org/linux-cve-announce/2026072420-CVE-2026-64254-0322@gregkh/T https://nvd.nist.gov/vuln/detail/CVE-2026-64254 https://www.cve.org/CVERecord?id=CVE-2026-64254
Metrics	threat_severity `None`	cvssV3_1 `{'score': 5.5, 'vector': 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H'}` threat_severity `Low`

Mon, 27 Jul 2026 06:30:00 +0000

Type	Values Removed	Values Added
Weaknesses		CWE-703 CWE-725

Fri, 24 Jul 2026 18:30:00 +0000

Type	Values Removed	Values Added
Description		In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR When BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, the module teardown path ends up calling pci_iounmap() on the same iomem with some offset, which is unnecessary and triggers a kernel warning like the following: Trying to vunmap() nonexistent vm area (0000000069a5ffe8) WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937 [...] Call trace: vunmap+0x58/0x68 (P) iounmap+0x34/0x48 pci_iounmap+0x2c/0x40 ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf] pci_device_remove+0x48/0xf8 device_remove+0x50/0x88 device_release_driver_internal+0x1c8/0x228 driver_detach+0x50/0xb0 bus_remove_driver+0x74/0x100 driver_unregister+0x34/0x68 pci_unregister_driver+0x34/0xa0 ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf] [...] Fix it by unmapping only when PEER_SPAD and CONFIG use difference bars.
Title		NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
First Time appeared		Linux Linux linux Kernel
CPEs		cpe:2.3:o:linux:linux_kernel::::::::
Vendors & Products		Linux Linux linux Kernel
References		https://git.kernel.org/stable/c/06f6dd2ff2bd07eaf7178a807407ff27e85122b4 https://git.kernel.org/stable/c/81371dbd23601f67f01372817fdbab42c5601e43 https://git.kernel.org/stable/c/9764a786ba98db58f0725913c369e721253aba33 https://git.kernel.org/stable/c/a4be4a1308f02bff79a30eea2d04ead5b63685f2 https://git.kernel.org/stable/c/d876153680e3d721d385e554def919bce3d18c74 https://git.kernel.org/stable/c/eb47b9bffd07a47b84910847cb5ea066ce184055

Subscriptions

Linux Linux Kernel

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2026-07-24T15:31:22.293Z

Updated: 2026-07-24T15:31:22.293Z

Reserved: 2026-07-19T15:36:31.773Z

Link: CVE-2026-64254

Vulnrichment

No data.

NVD

Status : Analyzed

Published: 2026-07-24T16:16:55.130

Modified: 2026-08-12T15:53:24.197

Link: CVE-2026-64254

Redhat

Severity : Low

Publid Date: 2026-07-24T00:00:00Z

Links: CVE-2026-64254 - Bugzilla

OpenCVE Enrichment

Updated: 2026-08-13T11:00:12Z

Weaknesses

CWE-617
Reachable Assertion

Impact

Affected Systems

Risk and Exploitability

Tracking

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

Subscriptions

JSON object

JSON object

JSON object

JSON object

JSON object