CVE-2026-64124: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64124 Overview

CVE-2026-64124 is a Linux kernel vulnerability in the net/devmem subsystem. The net_devmem_bind_dmabuf() function trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without verifying the assumption. A local attacker with the ability to bind a dma-buf can trigger an out-of-bounds access in the tx_vec array and desynchronize num_niovs from the underlying gen_pool region. The upstream fix rejects non-page-aligned sizes and scatter-gather lengths with -EINVAL.

Critical Impact
Local attackers can trigger kernel out-of-bounds reads and pool desynchronization on both RX and TX paths, threatening kernel confidentiality, integrity, and availability.

Affected Products

Linux kernel branches containing the devmem TCP/dma-buf bind code path
Distributions shipping affected stable kernel trees prior to the fix commits
Systems that expose net_devmem_bind_dmabuf() to unprivileged or containerized workloads

Discovery Timeline

2026-07-19 - CVE-2026-64124 published to NVD
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64124

Vulnerability Analysis

The vulnerability resides in net_devmem_bind_dmabuf() in the Linux kernel networking devmem code. The bind path assumes both dmabuf->size and each scatter-gather entry length reported by sg_dma_len() are exact multiples of PAGE_SIZE. The dma-buf subsystem does not require page-aligned sizes, so this assumption can be violated by any dma-buf exporter that produces a byte-granular size or a non-page-multiple non-final SG entry.

Two distinct memory safety issues result. First, tx_vec is allocated with dmabuf->size / PAGE_SIZE entries, but net_devmem_get_niov_at() only checks that virt_addr < dmabuf->size before computing tx_vec[virt_addr / PAGE_SIZE]. When size = N*PAGE_SIZE + r with 1 <= r < PAGE_SIZE, a sendmsg() call at iov_base = N*PAGE_SIZE passes the bound check and reads tx_vec[N], one entry past the allocation.

Second, owner->area.num_niovs is computed as len / PAGE_SIZE while gen_pool_add_owner() covers the entire byte length. A non-page-multiple, non-final SG entry desynchronizes num_niovs from the gen_pool region for every subsequent SG entry, affecting both RX and TX handling.

Root Cause

The root cause is missing input validation on values that the indexing logic implicitly treats as page-aligned. The bind path never enforces the alignment constraints that its own arithmetic depends on, producing an out-of-bounds read [CWE-125] and index desynchronization.

Attack Vector

Exploitation requires local access and low privileges to invoke the devmem TCP bind interface with a crafted dma-buf. The attacker supplies a dma-buf whose size is not a multiple of PAGE_SIZE, or whose scatter-gather list contains a non-final entry with non-page-multiple length. Subsequent sendmsg() operations then reach the out-of-bounds tx_vec element or interact with a desynchronized gen_pool region.

See the upstream fixes for the exact validation logic added by the maintainers: Kernel Git Commit 134c517, Kernel Git Commit 4eb82ba5, and Kernel Git Commit d5008e4e.

Detection Methods for CVE-2026-64124

Indicators of Compromise

Kernel log entries showing unexpected -EINVAL returns from net_devmem_bind_dmabuf() after patching, indicating prior misuse attempts.
KASAN or slab debug reports referencing tx_vec out-of-bounds reads inside net_devmem_get_niov_at().
Anomalous sendmsg() traffic patterns from processes that repeatedly bind dma-buf objects with unusual sizes.

Detection Strategies

Audit processes invoking devmem TCP bind operations and correlate with dma-buf allocation sources.
Enable KASAN on test kernels to surface out-of-bounds reads in the devmem code path.
Compare running kernel versions against the fixed stable commits to identify unpatched hosts at scale.

Monitoring Recommendations

Collect kernel telemetry for dmesg warnings, oops, and KASAN reports on hosts using devmem TCP.
Monitor which workloads and containers hold CAP_NET_ADMIN or otherwise reach the devmem bind syscall path.
Track dma-buf exporters in use and flag any that produce non-page-aligned buffer sizes for networking use.

How to Mitigate CVE-2026-64124

Immediate Actions Required

Apply the stable kernel updates containing commits 134c517, 4eb82ba5, and d5008e4e to reject non-page-aligned dma-buf binds.
Restrict access to devmem TCP bind functionality to trusted workloads only, particularly in multi-tenant hosts.
Rebuild and redeploy container host kernels once vendor packages incorporating the fix are available.

Patch Information

The fix adds explicit validation in net_devmem_bind_dmabuf() to reject dma-buf bindings with non-page-aligned dmabuf->size (TX path) and any scatter-gather entry with non-page-multiple length (both RX and TX). The size and SG-length checks return -EINVAL before the vulnerable indexing occurs. Reference the upstream commits: 134c517, 4eb82ba5, and d5008e4e.

Workarounds

Disable or unload devmem TCP functionality on hosts that do not require it until patches are applied.
Constrain untrusted workloads with seccomp or LSM policies to block sendmsg() paths that reach devmem binding.
Limit which processes can create or import dma-buf objects usable by the networking stack.

bash

# Verify running kernel includes the fix commits
uname -r
grep -E 'devmem|dma-buf' /proc/kallsyms | head
# After patching, confirm binds with non-page-aligned sizes are rejected with -EINVAL