The Linux kernel's dfl-afu driver accepted a 64-bit length parameter from userspace via the DFL_FPGA_PORT_DMA_MAP ioctl without validating an upper bound. This length was shifted to calculate the number of pages (npages) and passed as an int to pin_user_pages_fast(), causing implicit truncation if the length was very large. The vulnerability was addressed by validating the map.length at the ioctl entry point and rejecting requests where the page count exceeds INT_MAX, preventing integer truncation and potential misuse of the DMA mapping.

Improper validation of the DMA mapping length could lead to integer truncation, which may cause incorrect memory pinning behavior. This could potentially result in memory corruption or other unintended kernel behavior related to DMA operations in the FPGA driver. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to validate the DMA mapping length at the ioctl entry point, rejecting values whose page count exceeds INT_MAX. Users should update to a Linux kernel version that includes this fix once available. Patch status is not yet confirmed; check the vendor advisory for current remediation guidance.