PT-2026-61370 · Linux · Linux

CVE-2026-64053 · Published 2026-07-19 · Updated 2026-07-19

NVD

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

In the Linux kernel, the following vulnerability has been resolved:

block: don't overwrite bip vcnt in bio integrity copy user()

bio integrity add page() already sets bip vcnt to 1 for the bounce segment. Overwriting it with nr vecs breaks bip vcnt <= bip max vcnt on WRITE (bip max vcnt is 1), so the gap-merge checks in block/blk.h read past the bip vec[] flex array. On READ the read is in bounds but lands on a saved user bvec instead of the bounce.

The line was added for split propagation, but bio integrity clone() doesn't copy bip vcnt and BIP CLONE FLAGS excludes BIP COPY USER.

Fix

Related Identifiers

CVE-2026-64053

Affected Products

Linux

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2026-64053 · Security Note
• https://git.kernel.org/stable/c/0d48654af4d1390c888389206cc13b51b82c30e6 · Note
• https://git.kernel.org/stable/c/637ad3a56a3b889527d1dacea6fea2a8bd648140 · Note
• https://git.kernel.org/stable/c/066be1439593a381b1a29663becfcfe0c92363e7 · Note
• https://git.kernel.org/stable/c/d18160c9525c63c203656fefd847e94b538cd4a4 · Note