cve-2026-64051

HIGH CVSS 7.8 nvd

Description

In the Linux kernel, the following vulnerability has been resolved: accel/qaic: Add overflow check to remap_pfn_range during mmap The call to remap_pfn_range in qaic_gem_object_mmap is susceptible to (re)mapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap() unmaps only the VMA region and not the additional mappings. To prevent this, check the remaining size of the VMA before remapping and truncate the remapped length if sg->length is too large. [jhugo: fix braces from checkpatch --strict]

Timeline

Published: 2026-07-19
Last Modified: 2026-09-02

CVSS Details

Attack Vector: LOCAL
Attack Complexity: LOW
Privileges Required: LOW

Affected Products

linux linux_kernel

Weaknesses (CWE)

CWE-416

CVSS metrics

Version	Base	Severity	Vector	Exploitability	Impact	Source
3.1	7.8	HIGH	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`	1.8	5.9	416baaa9-dc9f-4396-8d5f-8c081fb06d67

CPE configurations

CPE	Version range	Vulnerable
`cpe:2.3:o:linux:linux_kernel::::::::`	>= 6.4, < 6.6.142	yes
`cpe:2.3:o:linux:linux_kernel::::::::`	>= 6.7, < 6.12.92	yes
`cpe:2.3:o:linux:linux_kernel::::::::`	>= 6.13, < 6.18.34	yes
`cpe:2.3:o:linux:linux_kernel::::::::`	>= 6.19, < 7.0.11	yes
`cpe:2.3:o:linux:linux_kernel:7.1:rc1::::::`	—	yes
`cpe:2.3:o:linux:linux_kernel:7.1:rc2::::::`	—	yes
`cpe:2.3:o:linux:linux_kernel:7.1:rc3::::::`	—	yes

NVD metadata

NVD status: Analyzed
Source identifier: 416baaa9-dc9f-4396-8d5f-8c081fb06d67

References

Linked Vulnerabilities

No linked vulnerabilities found.

{
  "cvss": 7.8,
  "datePublished": "2026-07-19T16:17:45.517",
  "dateUpdated": "2026-09-02T21:10:13.047",
  "description": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Add overflow check to remap_pfn_range during mmap\n\nThe call to remap_pfn_range in qaic_gem_object_mmap is susceptible to\n(re)mapping beyond the VMA if the BO is too large. This can cause use\nafter free issues when munmap() unmaps only the VMA region and not the\nadditional mappings. To prevent this, check the remaining size of the\nVMA before remapping and truncate the remapped length if sg->length is\ntoo large.\n\n[jhugo: fix braces from checkpatch --strict]",
  "id": "CVE-2026-64051",
  "raw": {
    "affected": [
      {
        "affectedData": [
          {
            "defaultStatus": "unaffected",
            "product": "Linux",
            "programFiles": [
              "drivers/accel/qaic/qaic_data.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "lessThan": "9baafc2fea096279e75480f93fd5942e8336b510",
                "status": "affected",
                "version": "ff13be8303336ead5621712f2c55012d738878b5",
                "versionType": "git"
              },
              {
                "lessThan": "8dd6edbe26770df147136c3f2ac976c873b82650",
                "status": "affected",
                "version": "ff13be8303336ead5621712f2c55012d738878b5",
                "versionType": "git"
              },
              {
                "lessThan": "97a8e89cdef36207a8776edc03d6931763a06ad0",
                "status": "affected",
                "version": "ff13be8303336ead5621712f2c55012d738878b5",
                "versionType": "git"
              },
              {
                "lessThan": "8c795012d0e06b7740e40319b86ff8d2a435098d",
                "status": "affected",
                "version": "ff13be8303336ead5621712f2c55012d738878b5",
                "versionType": "git"
              },
              {
                "lessThan": "aa16b2bc0f02709919e2435f531406531e5bcc69",
                "status": "affected",
                "version": "ff13be8303336ead5621712f2c55012d738878b5",
                "versionType": "git"
              }
            ]
          },
          {
            "defaultStatus": "affected",
            "product": "Linux",
            "programFiles": [
              "drivers/accel/qaic/qaic_data.c"
            ],
            "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
            "vendor": "Linux",
            "versions": [
              {
                "status": "affected",
                "version": "6.4"
              },
              {
                "lessThan": "6.4",
                "status": "unaffected",
                "version": "0",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.6.*",
                "status": "unaffected",
                "version": "6.6.142",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.12.*",
                "status": "unaffected",
                "version": "6.12.92",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "6.18.*",
                "status": "unaffected",
                "version": "6.18.34",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "7.0.*",
                "status": "unaffected",
                "version": "7.0.11",
                "versionType": "semver"
              },
              {
                "lessThanOrEqual": "*",
                "status": "unaffected",
                "version": "7.1",
                "versionType": "original_commit_for_fix"
              }
            ]
          }
        ],
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
      }
    ],
    "configurations": [
      {
        "nodes": [
          {
            "cpeMatch": [
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "65A69F97-C925-4335-9AFA-AC101723FB38",
                "versionEndExcluding": "6.6.142",
                "versionStartIncluding": "6.4",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "9CB90BD9-95B7-4D7F-9F17-4ECE6CFB66C9",
                "versionEndExcluding": "6.12.92",
                "versionStartIncluding": "6.7",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "A4B1EF6D-18D7-4838-BC37-7499D5DCC3C0",
                "versionEndExcluding": "6.18.34",
                "versionStartIncluding": "6.13",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                "matchCriteriaId": "0520D091-FC52-4A50-AF07-70AE7D08B750",
                "versionEndExcluding": "7.0.11",
                "versionStartIncluding": "6.19",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*",
                "matchCriteriaId": "B1EF7059-E670-45F4-B422-54C40FA86390",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*",
                "matchCriteriaId": "0D38F0BF-A728-4133-A358-D44A2F7EE6D6",
                "vulnerable": true
              },
              {
                "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*",
                "matchCriteriaId": "EC732D08-5F7B-46D9-B154-E60C7F4F0A97",
                "vulnerable": true
              }
            ],
            "negate": false,
            "operator": "OR"
          }
        ]
      }
    ],
    "cveTags": [],
    "descriptions": [
      {
        "lang": "en",
        "value": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Add overflow check to remap_pfn_range during mmap\n\nThe call to remap_pfn_range in qaic_gem_object_mmap is susceptible to\n(re)mapping beyond the VMA if the BO is too large. This can cause use\nafter free issues when munmap() unmaps only the VMA region and not the\nadditional mappings. To prevent this, check the remaining size of the\nVMA before remapping and truncate the remapped length if sg->length is\ntoo large.\n\n[jhugo: fix braces from checkpatch --strict]"
      }
    ],
    "id": "CVE-2026-64051",
    "lastModified": "2026-09-02T21:10:13.047",
    "metrics": {
      "cvssMetricV31": [
        {
          "cvssData": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "exploitabilityScore": 1.8,
          "impactScore": 5.9,
          "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
          "type": "Secondary"
        }
      ]
    },
    "published": "2026-07-19T16:17:45.517",
    "references": [
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/8c795012d0e06b7740e40319b86ff8d2a435098d"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/8dd6edbe26770df147136c3f2ac976c873b82650"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/97a8e89cdef36207a8776edc03d6931763a06ad0"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/9baafc2fea096279e75480f93fd5942e8336b510"
      },
      {
        "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "tags": [
          "Patch"
        ],
        "url": "https://git.kernel.org/stable/c/aa16b2bc0f02709919e2435f531406531e5bcc69"
      }
    ],
    "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "vulnStatus": "Analyzed",
    "weaknesses": [
      {
        "description": [
          {
            "lang": "en",
            "value": "CWE-416"
          }
        ],
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "severity": "HIGH",
  "source": "nvd",
  "title": "In the Linux kernel, the following vulnerability has been resolved:\n\naccel/qaic: Add overflow check to remap_pfn_rang..."
}

cve-2026-64051

Raw JSON Data