CVE-2026-64052: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64052 Overview

CVE-2026-64052 is a null pointer dereference vulnerability in the Linux kernel block layer, specifically in the bio_integrity_map_user() function used for block I/O integrity operations. The flaw stems from improper handling of partial success returns from pin_user_pages_fast(). When the function partially pins user pages, the code continues processing as if all pages were pinned, causing bvec_from_pages() to dereference an unpinned page address of 0. The result is a general protection fault in the kernel, triggering a kernel oops. The issue is reachable through NVMe passthrough operations and other paths that invoke bio integrity mapping from user memory.

Critical Impact
Local users can trigger a kernel general protection fault via crafted NVMe passthrough or bio integrity operations, resulting in denial of service through kernel panic.

Affected Products

Linux kernel versions containing the bio_integrity_map_user() implementation prior to the fix
Systems using NVMe passthrough with integrity metadata
Distributions shipping affected upstream kernel commits (see referenced stable git commits)

Discovery Timeline

2026-07-19 - CVE CVE-2026-64052 published to NVD
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64052

Vulnerability Analysis

The vulnerability resides in the block layer bio integrity subsystem, which handles Data Integrity Field (DIF) or Protection Information (PI) metadata attached to block I/O requests. The bio_integrity_map_user() function maps user-space memory containing integrity metadata into a bio structure for kernel processing.

To pin user pages, the function calls pin_user_pages_fast(). This API can return a positive value smaller than the requested page count, indicating that only a subset of pages was successfully pinned. The vulnerable code path does not compare the return value against the requested count. Instead, it proceeds to call bvec_from_pages() on the full page array, which contains uninitialized or zero entries for the unpinned slots.

Dereferencing a page pointer at address 0x0 triggers a general protection fault, detected by KASAN as a null pointer dereference in the range [0x0000000000000008-0x000000000000000f]. This classifies the issue as a null pointer dereference [CWE-476] leading to denial of service.

Root Cause

The root cause is missing validation of the pin_user_pages_fast() return value. The API contract permits partial success, but bio_integrity_map_user() assumes all-or-nothing semantics. When fewer pages are pinned than requested, the remaining slots in the pages array remain zero, and subsequent bvec_from_pages() processing dereferences these null entries.

Attack Vector

A local unprivileged or semi-privileged user with access to block devices supporting integrity metadata, such as NVMe devices via nvme-passthrough ioctls, can craft a request that induces partial page pinning. Memory pressure, unaligned buffers spanning unmapped regions, or races with munmap() can each cause pin_user_pages_fast() to return a partial count. The resulting kernel oops halts the calling context and can render the system unstable.

The upstream fix adds a check to verify that all requested pages are pinned. If partial pinning occurs, the fix unpins the pages already acquired and returns -EFAULT to the caller. See the referenced stable kernel commits for the exact patch content.

Detection Methods for CVE-2026-64052

Indicators of Compromise

Kernel log entries containing Oops: general protection fault referencing bio_integrity_map_user
KASAN reports indicating null-ptr-deref in range [0x0000000000000008-0x000000000000000f] from block layer call stacks
Unexpected system crashes or hangs originating from processes issuing NVMe passthrough commands
Repeated failures of ioctl() calls against /dev/nvme* devices from unprivileged workloads

Detection Strategies

Monitor dmesg and journalctl -k for kernel oops messages referencing bio_integrity_map_user or bvec_from_pages
Correlate kernel crash events with the user process name and UID captured in the oops trace, such as the nvme-passthroug comm seen in the reference report
Compare running kernel versions against the fixed commits listed in the referenced kernel.org stable trees

Monitoring Recommendations

Forward kernel logs to a centralized log platform and alert on general protection fault or KASAN strings
Track kernel panics and unexpected reboots on hosts running workloads that use block integrity metadata
Inventory hosts by kernel version and flag systems that have not applied the referenced stable patches

How to Mitigate CVE-2026-64052

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable kernel git commits 76410790, 77c059f4, 8582792c, and 8fa24473
Update to a distribution kernel package that incorporates the fix for bio_integrity_map_user()
Restrict access to NVMe passthrough interfaces to trusted administrative users where feasible

Patch Information

The fix is available in the mainline and stable Linux kernel trees. Reference commits:

The patch adds a check comparing the return value of pin_user_pages_fast() against the requested page count. When the counts differ, the patch calls unpin_user_pages() on the partially pinned set and returns -EFAULT instead of continuing into bvec_from_pages().

Workarounds

Disable or restrict use of block integrity metadata on affected hosts until patches are deployed
Limit access to /dev/nvme* device nodes and passthrough ioctls to privileged users only
Reduce memory pressure on affected systems, which lowers the probability of partial pin_user_pages_fast() returns

bash

# Verify installed kernel version and check for the fix
uname -r

# On distributions using package management, update the kernel
# Debian/Ubuntu
sudo apt-get update && sudo apt-get install --only-upgrade linux-image-$(uname -r | cut -d- -f2-)

# RHEL/CentOS/Fedora
sudo dnf update kernel

# Restrict access to NVMe passthrough devices
sudo chmod 600 /dev/nvme*
sudo chown root:disk /dev/nvme*