CVE-2026-64124 in Linux
Summary
by MITRE • 07/19/2026
In the Linux kernel, the following vulnerability has been resolved:
net: devmem: reject dma-buf bind with non-page-aligned size or SG length
net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without checking:
- tx_vec is sized dmabuf->size / PAGE_SIZE, and net_devmem_get_niov_at() only bounds-checks virt_addr < dmabuf->size before indexing tx_vec[virt_addr / PAGE_SIZE]. With size =
N*PAGE_SIZE + r (1 <= r < PAGE_SIZE), sendmsg() at iov_base = N*PAGE_SIZE passes the bound check and reads tx_vec[N] -- one past.
- owner->area.num_niovs = len / PAGE_SIZE while gen_pool_add_owner() covers the full byte len, so a non-page-multiple non-final sg desyncs num_niovs from the gen_pool region for every later sg, on both RX and TX.
dma-buf does not require page-aligned sizes, so the bind path has to enforce what its own indexing assumes. Reject both with -EINVAL.
The size check is TX-only (only tx_vec is sized off dmabuf->size); the SG-length check covers both directions.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/19/2026
This vulnerability exists in the Linux kernel's network device memory handling subsystem, specifically within the devmem functionality that manages direct memory access operations. The flaw stems from inadequate validation of dma-buf parameters during the binding process, creating potential for buffer overflows and memory corruption attacks. The vulnerability is classified as a classic buffer overflow condition where array indexing assumptions conflict with actual data boundaries, representing a critical security weakness in kernel space memory management.
The technical implementation flaw occurs in the net_devmem_bind_dmabuf() function which makes unwarranted assumptions about dma-buf size and scatter-gather list (SG) length parameters. The code trusts that dmabuf->size and sg_dma_len() values are always multiples of PAGE_SIZE without performing explicit validation checks. This trust-based approach creates a fundamental mismatch between the expected memory layout and actual data structures, leading to exploitable conditions in kernel memory management.
The operational impact of this vulnerability is severe as it enables attackers to craft malicious dma-buf operations that can cause buffer overflows through improper array indexing. The vulnerability affects both transmit and receive operations, with TX-only size checking and bidirectional SG length validation. When a non-page-aligned size is provided, the tx_vec array becomes misaligned with the actual data boundaries, allowing out-of-bounds memory access when the sendmsg() function processes iov_base values that exceed expected page boundaries. The gen_pool_add_owner() function creates additional desynchronization between the number of I/O vectors and the actual memory pool region, compounding the memory management issues.
The security implications extend beyond simple buffer overflows to include potential privilege escalation and system compromise through kernel memory corruption. Attackers could exploit this vulnerability by creating specially crafted dma-buf operations that manipulate the indexing calculations to access unauthorized memory regions. This represents a Type-1 buffer overflow condition (out-of-bounds read) as defined in CWE-121, where the program reads data beyond the allocated buffer boundaries. The vulnerability also aligns with ATT&CK technique T1068 which involves exploiting local privilege escalation through kernel vulnerabilities.
The recommended mitigation strategy involves implementing explicit validation checks for both dma-buf size and SG length parameters before any memory operations occur. The fix requires adding proper boundary checking to ensure all values are page-aligned multiples, rejecting invalid configurations with -EINVAL error codes as specified in the patch description. This approach directly addresses the root cause by enforcing the assumptions that the existing code relies upon, preventing the mismatch between expected and actual memory layouts that leads to buffer overflows.
Security practitioners should note this vulnerability's relationship to broader kernel memory management issues and consider implementing additional monitoring for dma-buf operations in production environments. The fix aligns with secure coding practices outlined in CERT Secure Coding Standards, particularly those addressing input validation and buffer boundary checking in kernel space operations. Organizations should prioritize applying the kernel patches that implement these validation checks to protect against potential exploitation of this memory corruption vulnerability.