In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()… (CVE-2026-64280)
A high-severity vulnerability in the Linux kernel's FPGA driver (dfl-afu) allows improper validation of a 64-bit DMA mapping length passed from userspace. The ioctl handler does not enforce an upper bound on the length, leading to an integer truncation when the length is converted to a page count, potentially causing memory corruption or escalation of privileges. The vulnerability is addressed by validating the length at the ioctl entry point and rejecting requests exceeding INT_MAX pages.
AI Analysis
Technical Summary
The Linux kernel's dfl-afu FPGA driver contained a vulnerability where the afu_ioctl_dma_map() function accepted a 64-bit length parameter from userspace without an upper bound check. This length is used to calculate the number of pages (npages) by shifting right by PAGE_SHIFT and then passed as an int to pin_user_pages_fast(). If the length is very large, this causes implicit truncation of npages due to the int parameter, potentially leading to memory corruption or other impacts. The fix involves validating the map.length parameter at the ioctl entry point to reject values whose page count exceeds INT_MAX, preventing the truncation and associated risks.
Potential Impact
This vulnerability allows a local attacker with permission to invoke the DFL_FPGA_PORT_DMA_MAP ioctl to cause memory corruption or escalate privileges by exploiting the integer truncation in page count calculation. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is applied, avoid invoking the affected ioctl with untrusted or excessively large length values. Monitor vendor channels for updates and apply the official fix once available.
In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()… (CVE-2026-64280)
Description
A high-severity vulnerability in the Linux kernel's FPGA driver (dfl-afu) allows improper validation of a 64-bit DMA mapping length passed from userspace. The ioctl handler does not enforce an upper bound on the length, leading to an integer truncation when the length is converted to a page count, potentially causing memory corruption or escalation of privileges. The vulnerability is addressed by validating the length at the ioctl entry point and rejecting requests exceeding INT_MAX pages.
CVSS v3.1
Score 8.8high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's dfl-afu FPGA driver contained a vulnerability where the afu_ioctl_dma_map() function accepted a 64-bit length parameter from userspace without an upper bound check. This length is used to calculate the number of pages (npages) by shifting right by PAGE_SHIFT and then passed as an int to pin_user_pages_fast(). If the length is very large, this causes implicit truncation of npages due to the int parameter, potentially leading to memory corruption or other impacts. The fix involves validating the map.length parameter at the ioctl entry point to reject values whose page count exceeds INT_MAX, preventing the truncation and associated risks.
Potential Impact
This vulnerability allows a local attacker with permission to invoke the DFL_FPGA_PORT_DMA_MAP ioctl to cause memory corruption or escalate privileges by exploiting the integer truncation in page count calculation. The CVSS score of 8.8 reflects high impact on confidentiality, integrity, and availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is applied, avoid invoking the affected ioctl with untrusted or excessively large length values. Monitor vendor channels for updates and apply the official fix once available.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-hj85-3f53-vrg4
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64280"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420e9c2644c7f8086322
Added to database: 07/25/2026, 23:09:02 UTC
Last enriched: 08/03/2026, 22:44:48 UTC
Last updated: 09/07/2026, 10:52:10 UTC
Views: 50
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.