CVE-2026-64254 Overview
CVE-2026-64254 is a Linux kernel vulnerability in the Non-Transparent Bridge (NTB) Endpoint Function (EPF) driver ntb_hw_epf. When the BAR_PEER_SPAD and BAR_CONFIG regions share the same PCI Base Address Register (BAR), the module teardown path calls pci_iounmap() on the same iomem region with an offset. This unnecessary unmap triggers a kernel warning from vunmap() about a nonexistent VM area during module removal.
The issue surfaces during ntb_epf_pci_remove() when unloading the driver, producing warnings at mm/vmalloc.c:3470. The fix restricts unmapping so it only occurs when PEER_SPAD and CONFIG use different BARs.
Critical Impact
Kernel warning during NTB EPF module teardown on systems where PEER_SPAD and CONFIG share a PCI BAR, indicating incorrect resource management in the driver unload path.
Affected Products
- Linux kernel ntb_hw_epf driver (NTB Endpoint Function)
- Stable kernel branches referenced by commits 06f6dd2, 81371db, 9764a78, a4be4a1, d876153, and eb47b9b
- Systems using NTB over PCIe Endpoint Function with shared BAR configuration
Discovery Timeline
- 2026-07-24 - CVE-2026-64254 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64254
Vulnerability Analysis
The vulnerability resides in the NTB EPF PCI driver removal path. The driver maps two logical regions, BAR_PEER_SPAD (peer scratchpad) and BAR_CONFIG (configuration), which can either occupy distinct PCI BARs or share a single BAR with an offset. When both regions share one BAR, the driver still calls pci_iounmap() twice on effectively the same underlying iomem mapping, with the second call using an offset pointer that does not correspond to a distinct VM area.
The kernel's vunmap() implementation detects the missing VM area and emits a warning: Trying to vunmap() nonexistent vm area, followed by a stack trace originating in ntb_epf_pci_remove+0x44/0x80. This is a kernel driver resource management defect rather than a memory-safety exploitation primitive.
Root Cause
The root cause is improper handling of the shared-BAR configuration in ntb_epf_pci_remove(). The teardown routine assumes each mapped region requires its own pci_iounmap() call. When PEER_SPAD and CONFIG alias the same BAR, only one unmap should occur. The patch adds a check to unmap only when the two regions use different BARs, preventing the redundant call. See the kernel commit d876153 for the applied fix.
Attack Vector
This vulnerability is not remotely exploitable. It manifests only during driver module removal on hardware configurations where BAR_PEER_SPAD and BAR_CONFIG share the same PCI BAR. Triggering the warning requires local privileges sufficient to load and unload kernel modules, such as running modprobe -r ntb_hw_epf. The impact is a kernel warning and potential instability of the NTB subsystem rather than privilege escalation or code execution.
Refer to the upstream advisory for full technical details of the fix.
Detection Methods for CVE-2026-64254
Indicators of Compromise
- Kernel log entries containing Trying to vunmap() nonexistent vm area correlated with ntb_hw_epf module unload
- WARNING at mm/vmalloc.c:3470 with a call trace referencing ntb_epf_pci_remove and pci_iounmap
- Repeated warnings during automated test cycles that load and unload the ntb_hw_epf driver
Detection Strategies
- Monitor dmesg and /var/log/kern.log for vunmap and ntb_epf_pci_remove warning signatures on systems using NTB EPF
- Inventory hosts running the ntb_hw_epf module and cross-reference kernel versions against the fixed commits
- Track kernel package versions across the fleet to identify systems still running vulnerable builds of the driver
Monitoring Recommendations
- Forward kernel logs to a central logging platform and alert on WARNING traces referencing NTB modules
- Include NTB EPF driver load and unload events in host telemetry collected by endpoint sensors
- Review PCIe endpoint device inventories to identify hardware likely to exercise the shared-BAR code path
How to Mitigate CVE-2026-64254
Immediate Actions Required
- Apply the stable kernel updates containing commits 06f6dd2, 81371db, 9764a78, a4be4a1, d876153, or eb47b9b as appropriate for your kernel branch
- Avoid repeated load and unload cycles of ntb_hw_epf on affected kernels in production until patched
- Validate that vendor-supplied kernels for embedded and PCIe endpoint platforms incorporate the fix
Patch Information
The fix modifies ntb_epf_pci_remove() to call pci_iounmap() on the PEER_SPAD mapping only when it resides on a different BAR from CONFIG. Distribution-provided stable kernels have merged the patch across multiple branches. Apply the vendor kernel update corresponding to your distribution and reboot to load the corrected module. See the kernel commit a4be4a1 and the kernel commit eb47b9b for backport references.
Workarounds
- Leave the ntb_hw_epf module loaded for the lifetime of the system to avoid triggering the teardown path
- Restrict module unload privileges by limiting root and CAP_SYS_MODULE access on affected hosts
- Where feasible, configure NTB EPF hardware so PEER_SPAD and CONFIG reside on distinct BARs, avoiding the shared-BAR code path
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
