In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length… (CVE-2026-64124)
In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without checking: - tx_vec is sized dmabuf->size / PAGE_SIZE, and net_devmem_get_niov_at() only bounds-checks virt_addr < dmabuf->size before indexing tx_vec[virt_addr / PAGE_SIZE]. With size = N*PAGE_SIZE + r (1 <= r < PAGE_SIZE), sendmsg() at iov_base = N*PAGE_SIZE passes the bound check and reads tx_vec[N] -- one past. - owner->area.num_niovs = len / PAGE_SIZE while gen_pool_add_owner() covers the full byte len, so a non-page-multiple non-final sg desyncs num_niovs from the gen_pool region for every later sg, on both RX and TX. dma-buf does not require page-aligned sizes, so the bind path has to enforce what its own indexing assumes. Reject both with -EINVAL. The size check is TX-only (only tx_vec is sized off dmabuf->size); the SG-length check covers both directions.
AI Analysis
Technical Summary
The Linux kernel vulnerability CVE-2026-64124 affects the net: devmem subsystem, specifically the net_devmem_bind_dmabuf() function. This function trusted that dma-buf sizes and scatter-gather lengths were multiples of PAGE_SIZE without verifying this assumption. Because tx_vec is sized based on dmabuf->size divided by PAGE_SIZE, a dma-buf size that is not page-aligned (N*PAGE_SIZE + r, where 1 <= r < PAGE_SIZE) allows an out-of-bounds read past the end of tx_vec during sendmsg() operations. Additionally, the number of IO vectors (num_niovs) calculated from SG lengths can become desynchronized from the actual memory pool regions, affecting both transmit and receive paths. The vulnerability is mitigated by rejecting dma-buf bindings with non-page-aligned sizes or SG lengths, returning -EINVAL to prevent unsafe memory operations.
Potential Impact
This vulnerability could lead to out-of-bounds memory access in the Linux kernel's network device memory management, potentially causing memory corruption or instability. The issue arises from assumptions about dma-buf size and scatter-gather list alignment that are not enforced, which could be exploited to read or write beyond allocated buffers. However, no known exploits are reported in the wild at this time.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel that rejects dma-buf bindings with non-page-aligned sizes or scatter-gather lengths by returning an error (-EINVAL). Users should apply the official kernel updates that include this patch to ensure the vulnerability is resolved. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed here; users should consult the relevant Linux kernel vendor advisories for the exact fixed versions and update accordingly.
In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length… (CVE-2026-64124)
Description
In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without checking: - tx_vec is sized dmabuf->size / PAGE_SIZE, and net_devmem_get_niov_at() only bounds-checks virt_addr < dmabuf->size before indexing tx_vec[virt_addr / PAGE_SIZE]. With size = N*PAGE_SIZE + r (1 <= r < PAGE_SIZE), sendmsg() at iov_base = N*PAGE_SIZE passes the bound check and reads tx_vec[N] -- one past. - owner->area.num_niovs = len / PAGE_SIZE while gen_pool_add_owner() covers the full byte len, so a non-page-multiple non-final sg desyncs num_niovs from the gen_pool region for every later sg, on both RX and TX. dma-buf does not require page-aligned sizes, so the bind path has to enforce what its own indexing assumes. Reject both with -EINVAL. The size check is TX-only (only tx_vec is sized off dmabuf->size); the SG-length check covers both directions.
CVSS v3.1
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel vulnerability CVE-2026-64124 affects the net: devmem subsystem, specifically the net_devmem_bind_dmabuf() function. This function trusted that dma-buf sizes and scatter-gather lengths were multiples of PAGE_SIZE without verifying this assumption. Because tx_vec is sized based on dmabuf->size divided by PAGE_SIZE, a dma-buf size that is not page-aligned (N*PAGE_SIZE + r, where 1 <= r < PAGE_SIZE) allows an out-of-bounds read past the end of tx_vec during sendmsg() operations. Additionally, the number of IO vectors (num_niovs) calculated from SG lengths can become desynchronized from the actual memory pool regions, affecting both transmit and receive paths. The vulnerability is mitigated by rejecting dma-buf bindings with non-page-aligned sizes or SG lengths, returning -EINVAL to prevent unsafe memory operations.
Potential Impact
This vulnerability could lead to out-of-bounds memory access in the Linux kernel's network device memory management, potentially causing memory corruption or instability. The issue arises from assumptions about dma-buf size and scatter-gather list alignment that are not enforced, which could be exploited to read or write beyond allocated buffers. However, no known exploits are reported in the wild at this time.
Mitigation Recommendations
A fix for this vulnerability has been implemented in the Linux kernel that rejects dma-buf bindings with non-page-aligned sizes or scatter-gather lengths by returning an error (-EINVAL). Users should apply the official kernel updates that include this patch to ensure the vulnerability is resolved. Since this is a kernel-level fix, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed here; users should consult the relevant Linux kernel vendor advisories for the exact fixed versions and update accordingly.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-36q3-p7rr-w76h
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64124"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a5d27a92a4a8d598912bbee
Added to database: 07/19/2026, 19:38:17 UTC
Last enriched: 07/19/2026, 19:50:25 UTC
Last updated: 07/20/2026, 19:41:21 UTC
Views: 13
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.