CVE-2026-64051 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
accel/qaic: Add overflow check to remap_pfn_range during mmap
The call to remap_pfn_range in qaic_gem_object_mmap is susceptible to (re)mapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap() unmaps only the VMA region and not the additional mappings. To prevent this, check the remaining size of the VMA before remapping and truncate the remapped length if sg->length is too large.
[jhugo: fix braces from checkpatch --strict]
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 07/19/2026
The vulnerability identified in the Linux kernel's qaic driver represents a critical memory management flaw that undermines the integrity of virtual memory addressing mechanisms. This issue specifically affects the acceleration infrastructure component responsible for managing graphics and compute operations through hardware acceleration units. The problem manifests when the qaic_gem_object_mmap function processes buffer object mappings, creating potential pathways for memory corruption and arbitrary code execution. The vulnerability stems from inadequate validation of mapping boundaries during the remap_pfn_range operation, which is fundamental to how kernel memory regions are mapped into user space virtual address spaces.
The technical implementation flaw occurs within the qaic_gem_object_mmap function where the remap_pfn_range call does not properly validate the relationship between the requested buffer object size and the available virtual memory area boundaries. When a buffer object exceeds the limits of its designated virtual memory region, the mapping operation can extend beyond the intended VMA boundaries into adjacent memory regions. This overflow condition creates a scenario where multiple distinct memory mappings may overlap or extend beyond their allocated bounds, fundamentally breaking the memory isolation guarantees that operating system kernel memory management relies upon. The vulnerability is classified as a buffer overflow in memory management operations and aligns with CWE-121, heap-based buffer overflow, and CWE-787, out-of-bounds write, within the Common Weakness Enumeration framework.
The operational impact of this vulnerability extends beyond simple memory corruption to encompass potential privilege escalation and system stability compromise. When munmap() attempts to release memory mappings, it only operates on the original VMA boundaries but fails to account for the additional overflowed mappings that were created during the initial remap_pfn_range call. This discrepancy leads to use-after-free conditions where freed memory structures remain accessible through the overflowed mappings, creating opportunities for attackers to manipulate kernel data structures or execute arbitrary code with kernel privileges. The attack surface is particularly concerning in environments where hardware acceleration drivers are actively used, as these components often run with elevated privileges and process sensitive data streams.
Mitigation strategies must address both the immediate code-level fix and broader system security posture considerations. The recommended solution involves implementing proper bounds checking before performing remap_pfn_range operations by examining the remaining VMA size and truncating the remapped length when the scatter-gather list indicates a mapping that exceeds available virtual memory space. This approach directly addresses the root cause by ensuring that all memory mappings remain strictly within their allocated boundaries, preventing both overflow conditions and the subsequent use-after-free scenarios. The fix should be accompanied by comprehensive testing of memory management pathways and consideration for similar vulnerabilities in other kernel subsystems. Security practitioners should monitor for related issues in hardware acceleration drivers and ensure proper kernel hardening configurations are implemented to reduce the attack surface. This vulnerability demonstrates the critical importance of memory boundary validation in kernel space operations and aligns with ATT&CK technique T1068, exploit for privilege escalation, as it provides a pathway for attackers to gain elevated system privileges through memory corruption vulnerabilities.