The Linux kernel’s fpga:dfl-afu driver accepts a 64‑bit DMA mapping length from user space without an upper bound check. The length value is used to calculate the number of pages, which is then truncated to a 32‑bit integer when passed to pin_user_pages_fast(). This implicit truncation can cause the driver to attempt to pin an excessive number of pages, potentially leading to memory corruption, a kernel panic or a denial of service condition. The issue is a classic integer truncation flaw that allows a user to force the driver into an invalid state.

All Linux kernel builds that contain the dfl-afu driver are affected. The vulnerability is present in the driver code for the device, so any kernel running on a host that can load the driver and expose the DFL_FPGA_PORT_DMA_MAP ioctl is potentially impacted. Version details are not specified in the data, so users should verify if their kernel includes the vendor-patched dfl-afu code.

This flaw can be leveraged only by processes that invoke the specific ioctl, implying a local privilege requirement. The EPSS score is less than 1%, and the vulnerability is not listed in the CISA KEV catalog, indicating a low probability of widespread exploitation. The CVSS score of 8.8 indicates high severity, underscoring the seriousness of the issue. Nonetheless, because a large mapping length can trigger a kernel crash, the risk of a denial of service for an affected host is significant. The exploit path involves sending a malicious length value via DFL_FPGA_PORT_DMA_MAP, which, in the absence of bounds checking, leads the driver to allocate more pages than intended.