CVE-2026-64254 in Linux
Summary
by MITRE • 07/24/2026
In the Linux kernel, the following vulnerability has been resolved:
NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
When BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, the module teardown path ends up calling pci_iounmap() on the same iomem with some offset, which is unnecessary and triggers a kernel warning like the following:
Trying to vunmap() nonexistent vm area (0000000069a5ffe8) WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937 [...]
Call trace: vunmap+0x58/0x68 (P) iounmap+0x34/0x48 pci_iounmap+0x2c/0x40 ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf]
pci_device_remove+0x48/0xf8 device_remove+0x50/0x88 device_release_driver_internal+0x1c8/0x228 driver_detach+0x50/0xb0 bus_remove_driver+0x74/0x100 driver_unregister+0x34/0x68 pci_unregister_driver+0x34/0xa0 ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf]
[...]
Fix it by unmapping only when PEER_SPAD and CONFIG use difference bars.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 07/24/2026
This vulnerability exists within the Linux kernel's NTB (Non-Transparent Bridge) implementation, specifically in the epf (endpoint function) module where improper memory management occurs during device teardown operations. The issue arises when the PEER_SPAD and CONFIG PCI BARs are configured to share a single physical memory region, creating a scenario where the kernel attempts to unmap the same virtual memory area multiple times with different offsets. This represents a classic case of resource management error that violates proper memory unmapping protocols and can lead to system instability or warnings during driver removal processes.
The technical flaw manifests in the pci_iounmap() function call within the ntb_epf_pci_remove() path where the kernel attempts to release virtual memory mappings without proper consideration of whether the PEER_SPAD and CONFIG BARs actually occupy separate memory regions. When these two BARs share a single PCI BAR, the module teardown code incorrectly calls pci_iounmap() on the same iomem resource with varying offset values, causing the kernel's vmalloc subsystem to detect an attempt to unmap a non-existent virtual memory area. This pattern directly corresponds to CWE-128, which describes improper handling of memory regions in kernel space operations.
The operational impact of this vulnerability extends beyond simple warning messages, as it represents a fundamental flaw in how the NTB driver manages memory resources during device lifecycle events. The kernel warning indicates that the system attempted to vunmap() a virtual memory address that no longer exists or was never properly allocated, which could potentially lead to memory corruption or system crashes under certain conditions. This type of memory management error aligns with ATT&CK technique T1068, specifically targeting privilege escalation through kernel memory manipulation, though in this case it manifests as a denial of service condition rather than active exploitation.
The fix implemented addresses the root cause by introducing a conditional check that only performs unmapping operations when PEER_SPAD and CONFIG BARs use different physical memory regions. This approach follows proper resource management principles and prevents the double unmap scenario that was triggering kernel warnings. The solution directly addresses the vulnerability by ensuring that pci_iounmap() is called only when necessary, avoiding unnecessary operations on shared memory resources while maintaining proper cleanup procedures for distinct memory regions. This represents a standard defensive programming technique that aligns with best practices for kernel module development and memory management in operating system contexts.
The vulnerability demonstrates the importance of careful resource management in kernel space where improper handling of shared resources can lead to system instability, particularly in device driver code that must properly account for hardware configuration variations. The fix ensures that the NTB driver correctly identifies when memory regions are shared versus separate, preventing the kernel from attempting invalid memory operations during module teardown. This type of vulnerability is particularly relevant in embedded systems and networking hardware where PCIe-based interconnects like NTB are commonly deployed, making proper driver resource management critical for system reliability and security.