CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-19 · updated 2026-09-02
Weakness: CWE-476

Description

In the Linux kernel, the following vulnerability has been resolved: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() pin_user_pages_fast() can partially succeed and return the number of pages that were actually pinned. However, the bio_integrity_map_user() does not handle this partial pinning. This leads to a general protection fault since bvec_from_pages() dereferences an unpinned page address, which is 0. To fix this, add a check to verify that all requested memory is pinned. If partial pinning occurs, unpin the memory and return -EFAULT. Kernel Oops: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 UID: 0 PID: 1061 Comm: nvme-passthroug Not tainted 7.0.0-11783-g90957f9314e8-dirty #16 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 RIP: 0010:bio_integrity_map_user.cold+0x1b0/0x9d6

Affected products

Linux kernel: from 6.8 before 6.12.92; from 6.13 before 6.18.34; from 6.19 before 7.0.11; 7.1-rc1, 7.1-rc2, 7.1-rc3 — fixed in 6.12.92, 6.18.34, 7.0.11

How to fix

Upgrade to a fixed version: Linux kernel 6.12.92, 6.18.34, 7.0.11. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2026-64052 or the next vulnerability affects your stack