CVE-2026-64051: Linux Kernel Use-After-Free Vulnerability

CVE-2026-64051 Overview

CVE-2026-64051 is a Linux kernel vulnerability in the accel/qaic driver, which supports Qualcomm AIC accelerator hardware. The flaw resides in the qaic_gem_object_mmap function, where the call to remap_pfn_range lacks an overflow check against the Virtual Memory Area (VMA) size. When a Buffer Object (BO) is larger than the VMA, the driver remaps memory beyond the intended region. A subsequent munmap() only tears down the VMA region, leaving additional mappings intact and triggering a use-after-free condition. Local authenticated users with access to the qaic device can exploit this weakness to corrupt kernel memory.

Critical Impact
Local attackers with access to the qaic accelerator device can trigger a use-after-free in the Linux kernel, potentially leading to privilege escalation, kernel memory corruption, or denial of service.

Affected Products

Linux kernel builds that include the accel/qaic driver for Qualcomm Cloud AI accelerators
Systems using Qualcomm AIC hardware with kernel Direct Rendering Manager (DRM) accelerator subsystem enabled
Distributions shipping vulnerable kernel versions prior to the upstream stable fixes referenced in the kernel.org commits

Discovery Timeline

2026-07-19 - CVE-2026-64051 published to the National Vulnerability Database (NVD)
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64051

Vulnerability Analysis

The vulnerability affects the memory mapping path of the Qualcomm AIC (qaic) accelerator driver. In qaic_gem_object_mmap, the driver iterates over scatter-gather (sg) entries associated with a Graphics Execution Manager (GEM) Buffer Object and calls remap_pfn_range to establish page frame number mappings into user space.

The function does not validate that the cumulative length of the scatter-gather entries remains within the bounds of the caller-supplied VMA. When a Buffer Object exceeds the size of the VMA, remap_pfn_range writes page table entries beyond vma->vm_end. These extra mappings are not tracked by the VMA structure.

A later munmap() call unmaps only the region described by the VMA. The overflowed page table entries remain in the process address space and continue to reference kernel pages that may be freed by the driver. Access through the stale mappings then produces a use-after-free.

Root Cause

The root cause is a missing bounds check between the scatter-gather segment length (sg->length) and the remaining space in the VMA before calling remap_pfn_range. The upstream fix compares the remaining VMA size against sg->length and truncates the remap length when the segment would overflow.

Attack Vector

Exploitation requires local access with low privileges and permission to open the qaic device node. An attacker crafts a Buffer Object larger than the VMA passed to mmap(), triggers the overflow of page table entries, then unmaps and continues to access the leaked mappings. This aligns with a Use After Free primitive in kernel memory. The vulnerability manifests through the standard DRM/accel mmap interface — see the kernel.org fix commits for the exact patched code path.

// Code example unavailable - refer to upstream kernel commits for the
// exact patched implementation of qaic_gem_object_mmap()

Detection Methods for CVE-2026-64051

Indicators of Compromise

Unexpected kernel oops or panic messages referencing qaic_gem_object_mmap or remap_pfn_range in dmesg or /var/log/kern.log
KASAN (Kernel Address Sanitizer) reports flagging use-after-free within the accel/qaic subsystem
Processes with CAP_SYS_ADMIN or qaic device access performing anomalous mmap/munmap sequences against /dev/accel/accel* nodes

Detection Strategies

Audit kernel version and confirm whether the accel/qaic module is loaded using lsmod | grep qaic on systems with Qualcomm AIC hardware
Monitor system logs for kernel warnings, GPF (General Protection Fault), or slab corruption reports correlated with qaic device usage
Correlate local user activity opening /dev/accel/* device nodes with subsequent kernel instability events

Monitoring Recommendations

Enable KASAN and CONFIG_DEBUG_VM on test kernels to surface out-of-bounds page table modifications during QA validation
Ship kernel logs to a centralized logging or SIEM platform and alert on stack traces containing qaic symbols
Track processes invoking accelerator ioctls with process telemetry and flag non-standard callers

How to Mitigate CVE-2026-64051

Immediate Actions Required

Apply the upstream Linux kernel patches referenced by commits aa16b2bc0f02, 8c795012d0e0, 8dd6edbe2677, 97a8e89cdef3, and 9baafc2fea09 on kernel.org
Update to a distribution kernel that incorporates the accel/qaic overflow check for remap_pfn_range
Restrict access to qaic accelerator device nodes to trusted users and service accounts only

Patch Information

The fix adds an explicit check of remaining VMA size before each remap_pfn_range call in qaic_gem_object_mmap and truncates the remap length when sg->length would exceed the VMA. Backports are available in multiple stable trees. Refer to the primary patch commit and the additional stable backports on kernel.org.

Workarounds

Unload the qaic kernel module with modprobe -r qaic on systems that do not require Qualcomm AIC accelerator functionality
Blacklist the module via /etc/modprobe.d/blacklist-qaic.conf to prevent automatic loading at boot
Tighten device node permissions on /dev/accel/* so only vetted service accounts can open the accelerator interface

bash

# Configuration example: blacklist the qaic module until patches are applied
echo "blacklist qaic" | sudo tee /etc/modprobe.d/blacklist-qaic.conf
sudo modprobe -r qaic 2>/dev/null || true

# Restrict device node access
sudo chmod 0600 /dev/accel/accel* 2>/dev/null || true

# Verify running kernel includes the fix
uname -r
dmesg | grep -i qaic