CVE-2026-64280

In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is derived as length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes int nr_pages, causing implicit truncation if length is very large. Validate map.length at the ioctl entry point before calling afu_dma_map_region(), rejecting values whose page count exceeds INT_MAX.

CVSS v3 8.8 HIGH

8.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.0 / Impact : 6.0

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope CHANGED

References

Link	Resource
https://git.kernel.org/stable/c/16381bda90b261a656ded0568630c1b857b2ebc8	Patch
https://git.kernel.org/stable/c/5352d488ce4ae5e8c68c080ad4c3a5f084ad5fbc
https://git.kernel.org/stable/c/59070040fd12e0b78d7b4d341d9f9a183237c5ff	Patch
https://git.kernel.org/stable/c/a6a3884ff500f04f3088d6d09eec803cd35331a2
https://git.kernel.org/stable/c/b50e6cd2395cde615f59b624819998d28c0668d6	Patch
https://git.kernel.org/stable/c/d7e787eee2ea619b6dbb98890472ee73daf2e7fd
https://git.kernel.org/stable/c/fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231	Patch
https://git.kernel.org/stable/c/fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27	Patch

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::
	cpe:2.3:o:linux:linux_kernel::::::::

History

No history.

Information

Published : 2026-07-25 10:17

Updated : 2026-08-23 13:16

NVD link : CVE-2026-64280

Mitre link : CVE-2026-64280

CVE.ORG link : CVE-2026-64280

JSON object : View

Products Affected

linux

linux_kernel

CWE

NVD-CWE-noinfo

{"id": "CVE-2026-64280", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Secondary", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 6.0, "exploitabilityScore": 2.0}]}, "affected": [{"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "affectedData": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "fa8dda1edef9ebc3af467c644c5533ac97171e12", "lessThan": "5352d488ce4ae5e8c68c080ad4c3a5f084ad5fbc", "versionType": "git"}, {"status": "affected", "version": "fa8dda1edef9ebc3af467c644c5533ac97171e12", "lessThan": "d7e787eee2ea619b6dbb98890472ee73daf2e7fd", "versionType": "git"}, {"status": "affected", "version": "fa8dda1edef9ebc3af467c644c5533ac97171e12", "lessThan": "a6a3884ff500f04f3088d6d09eec803cd35331a2", "versionType": "git"}, {"status": "affected", "version": "fa8dda1edef9ebc3af467c644c5533ac97171e12", "lessThan": "16381bda90b261a656ded0568630c1b857b2ebc8", "versionType": "git"}, {"status": "affected", "version": "fa8dda1edef9ebc3af467c644c5533ac97171e12", "lessThan": "b50e6cd2395cde615f59b624819998d28c0668d6", "versionType": "git"}, {"status": "affected", "version": "fa8dda1edef9ebc3af467c644c5533ac97171e12", "lessThan": "59070040fd12e0b78d7b4d341d9f9a183237c5ff", "versionType": "git"}, {"status": "affected", "version": "fa8dda1edef9ebc3af467c644c5533ac97171e12", "lessThan": "fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231", "versionType": "git"}, {"status": "affected", "version": "fa8dda1edef9ebc3af467c644c5533ac97171e12", "lessThan": "fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27", "versionType": "git"}], "programFiles": ["drivers/fpga/dfl-afu-main.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "4.19"}, {"status": "unaffected", "version": "0", "lessThan": "4.19", "versionType": "semver"}, {"status": "unaffected", "version": "5.10.266", "versionType": "semver", "lessThanOrEqual": "5.10.*"}, {"status": "unaffected", "version": "5.15.217", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.184", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.148", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.12.101", "versionType": "semver", "lessThanOrEqual": "6.12.*"}, {"status": "unaffected", "version": "6.18.39", "versionType": "semver", "lessThanOrEqual": "6.18.*"}, {"status": "unaffected", "version": "7.1.4", "versionType": "semver", "lessThanOrEqual": "7.1.*"}, {"status": "unaffected", "version": "7.2", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["drivers/fpga/dfl-afu-main.c"], "defaultStatus": "affected"}]}], "published": "2026-07-25T10:17:08.553", "references": [{"url": "https://git.kernel.org/stable/c/16381bda90b261a656ded0568630c1b857b2ebc8", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/5352d488ce4ae5e8c68c080ad4c3a5f084ad5fbc", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/59070040fd12e0b78d7b4d341d9f9a183237c5ff", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/a6a3884ff500f04f3088d6d09eec803cd35331a2", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/b50e6cd2395cde615f59b624819998d28c0668d6", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/d7e787eee2ea619b6dbb98890472ee73daf2e7fd", "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}, {"url": "https://git.kernel.org/stable/c/fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27", "tags": ["Patch"], "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nfpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()\n\nafu_ioctl_dma_map() accepts a 64-bit length from userspace via\nDFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value\nis passed to afu_dma_pin_pages() where npages is derived as\nlength >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes\nint nr_pages, causing implicit truncation if length is very large.\n\nValidate map.length at the ioctl entry point before calling\nafu_dma_map_region(), rejecting values whose page count exceeds\nINT_MAX."}], "lastModified": "2026-08-23T13:16:31.533", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "045A3DD5-C75E-400D-9A00-47E16F528EEF", "versionEndExcluding": "6.6.148", "versionStartIncluding": "4.19"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A4402C34-0450-4C2E-B4BF-63320A4A4FF9", "versionEndExcluding": "6.12.101", "versionStartIncluding": "6.7"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "914AE4BC-3D59-4C5A-9DB5-9CE327B429F7", "versionEndExcluding": "6.18.39", "versionStartIncluding": "6.13"}, {"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6228DDD6-4557-4AA3-9F43-AB995D471E42", "versionEndExcluding": "7.1.4", "versionStartIncluding": "6.19"}], "operator": "OR"}]}], "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"}