PT-2026-61370 · Linux · Linux

CVE-2026-64053 · Publicado 2026-07-19 · Atualizado 2026-07-19

NVD

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

block: don't overwrite bip vcnt in bio integrity copy user()

bio integrity add page() already sets bip vcnt to 1 for the bounce segment. Overwriting it with nr vecs breaks bip vcnt <= bip max vcnt on WRITE (bip max vcnt is 1), so the gap-merge checks in block/blk.h read past the bip vec[] flex array. On READ the read is in bounds but lands on a saved user bvec instead of the bounce.

The line was added for split propagation, but bio integrity clone() doesn't copy bip vcnt and BIP CLONE FLAGS excludes BIP COPY USER.

Correção

Identificadores relacionados

CVE-2026-64053

Produtos afetados

Linux

Referências · 5

• https://git.kernel.org/stable/c/0d48654af4d1390c888389206cc13b51b82c30e6 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2026-64053 · Nota de Segurança
• https://git.kernel.org/stable/c/637ad3a56a3b889527d1dacea6fea2a8bd648140 · Nota
• https://git.kernel.org/stable/c/066be1439593a381b1a29663becfcfe0c92363e7 · Nota
• https://git.kernel.org/stable/c/d18160c9525c63c203656fefd847e94b538cd4a4 · Nota