PT-2026-64369 · Linux · Linux

CVE-2026-64254 · Published 2026-07-24 · Updated 2026-07-24

Mitre

In the Linux kernel, the following vulnerability has been resolved:

NTB: epf: Avoid pci iounmap() with offset when PEER SPAD and CONFIG share BAR

When BAR PEER SPAD and BAR CONFIG share one PCI BAR, the module teardown path ends up calling pci iounmap() on the same iomem with some offset, which is unnecessary and triggers a kernel warning like the following:

Trying to vunmap() nonexistent vm area (0000000069a5ffe8) WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937 [...] Call trace: vunmap+0x58/0x68 (P) iounmap+0x34/0x48 pci iounmap+0x2c/0x40 ntb epf pci remove+0x44/0x80 [ntb hw epf] pci device remove+0x48/0xf8 device remove+0x50/0x88 device release driver internal+0x1c8/0x228 driver detach+0x50/0xb0 bus remove driver+0x74/0x100 driver unregister+0x34/0x68 pci unregister driver+0x34/0xa0 ntb epf pci driver exit+0x14/0xfe0 [ntb hw epf] [...]

Fix it by unmapping only when PEER SPAD and CONFIG use difference bars.

Related Identifiers

CVE-2026-64254

Affected Products

Linux

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2026-64254 · Security Note
• https://git.kernel.org/stable/c/06f6dd2ff2bd07eaf7178a807407ff27e85122b4 · Note
• https://git.kernel.org/stable/c/9764a786ba98db58f0725913c369e721253aba33 · Note
• https://git.kernel.org/stable/c/eb47b9bffd07a47b84910847cb5ea066ce184055 · Note
• https://git.kernel.org/stable/c/a4be4a1308f02bff79a30eea2d04ead5b63685f2 · Note
• https://git.kernel.org/stable/c/81371dbd23601f67f01372817fdbab42c5601e43 · Note
• https://git.kernel.org/stable/c/d876153680e3d721d385e554def919bce3d18c74 · Note