CVE-2026-64280 in Linux
Summary
by MITRE • 07/25/2026
In the Linux kernel, the following vulnerability has been resolved:
fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is derived as length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes int nr_pages, causing implicit truncation if length is very large.
Validate map.length at the ioctl entry point before calling afu_dma_map_region(), rejecting values whose page count exceeds INT_MAX.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 08/17/2026
This vulnerability exists within the linux kernel's fpga subsystem specifically in the dfl-afu driver component where improper validation of dma mapping parameters creates a potential integer overflow condition. The flaw occurs in the afu_ioctl_dma_map() function which processes user-supplied 64-bit length values through the DFL_FPGA_PORT_DMA_MAP ioctl interface without implementing appropriate upper bounds checking. When these large values are processed, they undergo calculation to determine page counts using the formula length >> PAGE_SHIFT which results in npages being derived as a 64-bit value. This calculated page count is then passed to the pin_user_pages_fast() function which expects an int type parameter for nr_pages, creating an implicit truncation scenario where values exceeding the maximum representable integer cause data corruption and potential exploitation opportunities.
The technical implementation of this vulnerability demonstrates a classic case of integer overflow and type conversion issues that fall under CWE-190 - Integer Overflow or Wraparound. The operational impact arises from the fact that when userspace provides extremely large dma mapping length values, the kernel's memory management subsystem can be manipulated to cause unexpected behavior during page pinning operations. The truncation of large 64-bit values to 32-bit integers in the pin_user_pages_fast() call creates a situation where the kernel may attempt to map an unexpectedly small number of pages while the original intent was to map many more, potentially leading to memory corruption or privilege escalation scenarios.
This vulnerability directly relates to ATT&CK technique T1068 - Exploitation for Privilege Escalation and T1203 - Exploitation of Remote Services by exploiting improper input validation in kernel space operations. The attack surface is particularly concerning because it operates at the kernel level where successful exploitation could result in complete system compromise, allowing malicious users to gain elevated privileges or cause denial of service conditions. The vulnerability represents a failure in the principle of least privilege as the kernel does not adequately validate user inputs before processing them in memory management operations, creating potential for attackers to manipulate kernel memory allocation behavior.
The recommended mitigation strategy involves implementing strict input validation at the ioctl entry point by checking that the calculated page count from the provided length parameter does not exceed INT_MAX before proceeding with any dma mapping operations. This approach aligns with secure coding practices and follows the principle of defense in depth by validating inputs early in the processing pipeline. The fix ensures that all user-supplied dma mapping lengths are properly bounded, preventing the integer truncation issue while maintaining the functionality of legitimate use cases. Additionally, this vulnerability highlights the importance of proper type handling in kernel space programming where 64-bit values must be carefully validated before being passed to functions expecting smaller integer types, emphasizing the need for comprehensive testing and validation of kernel subsystems against edge case inputs.