CVE-2026-64053: Linux Kernel Privilege Escalation Flaw

CVE-2026-64053 Overview

CVE-2026-64053 is a Linux kernel vulnerability in the block layer integrity handling code. The flaw resides in bio_integrity_copy_user(), where the bip_vcnt field is incorrectly overwritten with nr_vecs after bio_integrity_add_page() has already set it to 1 for the bounce segment. This overwrite breaks the invariant bip_vcnt <= bip_max_vcnt (where bip_max_vcnt is 1) on WRITE operations, causing gap-merge checks in block/blk.h to read past the bip_vec[] flexible array. On READ operations, the access lands on a saved user bvec instead of the bounce buffer.

Critical Impact
A local, low-privileged user with access to block devices supporting data integrity extensions can trigger out-of-bounds memory reads, potentially leading to information disclosure, kernel memory corruption, or denial of service.

Affected Products

Linux kernel versions containing the affected bio_integrity_copy_user() implementation in the block layer
Systems using storage devices with T10 Protection Information (PI) or data integrity extensions (DIX)
Distributions shipping kernels prior to the fix commits 066be14, 0d48654, 637ada3, and d18160c

Discovery Timeline

2026-07-19 - CVE-2026-64053 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64053

Vulnerability Analysis

The vulnerability affects the block integrity payload (BIP) handling path used when copying user-supplied integrity metadata into kernel bounce buffers. bio_integrity_add_page() is invoked first and correctly sets bip_vcnt to 1, reflecting the single bounce segment allocated for the operation. The offending line in bio_integrity_copy_user() subsequently overwrites bip_vcnt with nr_vecs, the count of the user's original vectors.

Because bip_max_vcnt remains 1, the invariant bip_vcnt <= bip_max_vcnt no longer holds. Downstream code in block/blk.h uses bip_vcnt to iterate the bip_vec[] flexible array member when performing gap-merge checks, resulting in reads beyond the allocated array bounds. This constitutes an out-of-bounds read [CWE-125] within kernel address space.

Root Cause

The root cause is a redundant assignment introduced for split propagation logic. However, bio_integrity_clone() does not copy bip_vcnt, and the BIP_CLONE_FLAGS mask explicitly excludes BIP_COPY_USER, making the overwrite unnecessary. The fix removes the line entirely, preserving the value set by bio_integrity_add_page().

Attack Vector

Exploitation requires local access with the ability to issue I/O to a block device that supports integrity metadata. An attacker submits crafted user integrity vectors through interfaces such as io_uring or direct I/O paths that route through bio_integrity_copy_user(). On WRITE, the kernel reads adjacent heap memory during gap-merge evaluation. On READ, the access targets a saved user bvec, which may enable controlled data exposure or corruption depending on adjacent allocations.

No verified public proof-of-concept code is available. Technical details are documented in the upstream fix commits referenced by NVD.

Detection Methods for CVE-2026-64053

Indicators of Compromise

Kernel oops or panic messages referencing bio_integrity_copy_user, bio_integrity_add_page, or blk.h gap-merge functions
KASAN reports flagging slab-out-of-bounds reads in the block integrity subsystem
Unexpected process crashes during I/O to devices with T10 PI enabled
Anomalous io_uring submission patterns from unprivileged processes involving integrity payloads

Detection Strategies

Enable CONFIG_KASAN on test kernels to surface out-of-bounds accesses in bio_integrity_copy_user() during fuzzing
Audit kernel version banners across the fleet and cross-reference against the fix commits 066be14, 0d48654, 637ada3, and d18160c
Monitor dmesg and syslog for block layer warnings on hosts with NVMe or SCSI devices using data integrity features

Monitoring Recommendations

Track kernel crash telemetry and correlate with I/O workloads targeting integrity-capable storage
Baseline io_uring usage per user and alert on unprivileged processes issuing integrity-flagged operations
Ingest kernel logs into a centralized log platform to detect repeated block integrity faults across hosts

How to Mitigate CVE-2026-64053

Immediate Actions Required

Identify all Linux hosts running kernel builds that include the vulnerable bio_integrity_copy_user() code path
Apply vendor-supplied kernel updates that incorporate upstream commits 066be14, 0d48654, 637ada3, or d18160c
Restrict local shell access on multi-tenant systems until patched kernels are deployed
Review io_uring exposure and consider disabling for untrusted users via kernel.io_uring_disabled where feasible

Patch Information

The upstream fix removes the erroneous bip_vcnt = nr_vecs assignment from bio_integrity_copy_user(). Patched commits are available from the mainline and stable trees: Kernel Git Commit 066be14, Kernel Git Commit 0d48654, Kernel Git Commit 637ada3, and Kernel Git Commit d18160c. Consult your distribution's security tracker for backported package versions.

Workarounds

Disable T10 Protection Information on affected block devices where operationally acceptable to avoid the vulnerable code path
Set kernel.io_uring_disabled=2 via sysctl to block untrusted io_uring submissions that could reach the integrity copy path
Limit access to raw block devices through strict Unix permissions and mandatory access control policies

bash

# Configuration example: verify running kernel and restrict io_uring for non-root users
uname -r
sysctl -w kernel.io_uring_disabled=2
echo 'kernel.io_uring_disabled=2' | sudo tee /etc/sysctl.d/99-cve-2026-64053.conf