In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()… (CVE-2026-64280)
Source GCVE Database
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 5% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:HWhat to do
AI-suggested
Until an official fix is applied, avoid invoking the affected ioctl with untrusted or excessively large length values. Monitor vendor channels for updates and apply the official fix once available.
Description
A high-severity vulnerability in the Linux kernel's FPGA driver (dfl-afu) allows improper validation of a 64-bit DMA mapping length passed from userspace. The ioctl handler does not enforce an upper bound on the length, leading to an integer truncation when the length is converted to a page count, potentially causing memory corruption or escalation of privileges. The vulnerability is addressed by validating the length at the ioctl entry point and rejecting requests exceeding INT_MAX pages.
Impact
This vulnerability allows a local attacker with permission to invoke the DFL_FPGA_PORT_DMA_MAP ioctl to cause memory corruption or escalate privileges by exploiting the integer truncation in page count calculation. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.
Summary
The Linux kernel's dfl-afu FPGA driver contained a vulnerability where the afu_ioctl_dma_map() function accepted a 64-bit length parameter from userspace without an upper bound check. This length is used to calculate the number of pages (npages) by shifting right by PAGE_SHIFT and then passed as an int to pin_user_pages_fast(). If the length is very large, this causes implicit truncation of npages due to the int parameter, potentially leading to memory corruption or other impacts. The fix involves validating the map.length parameter at the ioctl entry point to reject values whose page count exceeds INT_MAX, preventing the truncation and associated risks.
References
- nvd.nist.gov/vuln/detail/CVE-2026-64280 (opens in a new tab)
- git.kernel.org/stable/c/59070040fd12e0b78d7b4d341d9f9a183237c5ff (opens in a new tab)
- git.kernel.org/stable/c/fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231 (opens in a new tab)
- git.kernel.org/stable/c/fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27 (opens in a new tab)
- git.kernel.org/stable/c/16381bda90b261a656ded0568630c1b857b2ebc8 (opens in a new tab)
- git.kernel.org/stable/c/b50e6cd2395cde615f59b624819998d28c0668d6 (opens in a new tab)