CVE-2026-64052 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()
pin_user_pages_fast() can partially succeed and return the number of pages that were actually pinned. However, the bio_integrity_map_user() does not handle this partial pinning. This leads to a general protection fault since bvec_from_pages() dereferences an unpinned page address, which is 0.
To fix this, add a check to verify that all requested memory is pinned. If partial pinning occurs, unpin the memory and return -EFAULT.
Kernel Oops:
Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 0 PID: 1061 Comm: nvme-passthroug Not tainted 7.0.0-11783-g90957f9314e8-dirty #16 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 RIP: 0010:bio_integrity_map_user.cold+0x1b0/0x9d6
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability resides within the linux kernel's block layer subsystem specifically in the bio-integrity component responsible for handling data integrity operations. The issue manifests in the bio_integrity_map_user() function which processes user-space memory mappings for integrity verification purposes. The flaw occurs when pinning user pages using pin_user_pages_fast() where partial success can occur, meaning only some of the requested pages are successfully pinned while others fail. This function fails to properly handle this scenario and continues execution assuming all pages were successfully pinned, leading to a null pointer dereference when bvec_from_pages() attempts to process what it believes are valid page addresses but are actually zero values from partially pinned memory regions.
The technical implementation problem stems from the kernel's memory management and virtual memory subsystem interaction where pin_user_pages_fast() is designed to return partial success counts when not all pages can be pinned due to various constraints such as memory pressure, access permissions, or system resource limitations. When this happens, the bio_integrity_map_user() function does not validate that all requested pages were actually pinned before proceeding with operations that assume complete pinning. The resulting general protection fault occurs because bvec_from_pages() receives page addresses that are null pointers rather than valid physical addresses, causing a kernel oops and system crash.
The operational impact of this vulnerability is significant as it represents a denial-of-service condition that can be triggered through malicious or malformed user-space operations involving block device integrity checking. Attackers could potentially exploit this by crafting specific I/O operations that cause partial pinning scenarios, leading to system crashes and service disruption. The vulnerability affects any system running the affected kernel version where bio-integrity functionality is enabled, particularly impacting storage subsystems that utilize integrity checking mechanisms such as NVMe passthrough operations as evidenced by the comm name in the kernel oops trace. This issue directly relates to CWE-476 Null Pointer Dereference and aligns with ATT&CK technique T1499.004 for resource exhaustion through system instability.
The fix implements proper validation by checking whether pin_user_pages_fast() successfully pinned all requested pages before proceeding with integrity mapping operations. When partial pinning occurs, the function now correctly undoes any successful pinning operations and returns appropriate error codes indicating failure to the calling context. This defensive programming approach prevents the kernel from attempting to process invalid page addresses while maintaining proper error propagation through the system call interface. The solution follows established kernel security patterns for handling partial memory operations and ensures consistent error handling across all memory management subsystems, preventing similar issues in related functions that may encounter the same partial pinning conditions during user page operations.
This vulnerability demonstrates the critical importance of proper error handling in kernel space where partial success conditions can lead to catastrophic system failures. The fix reinforces proper resource management principles by ensuring that if any part of a multi-step operation fails, all previous steps are properly rolled back before propagating the error. This approach prevents the kernel from entering inconsistent states and maintains system stability even when individual operations cannot complete entirely. The security implications extend beyond simple crash protection to maintaining system integrity in storage subsystems where data consistency verification is paramount for enterprise and mission-critical deployments.