CVE-2026-64051

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the qaic gem object mmap function where the call to remap pfn range is susceptible to mapping beyond the Virtual Memory Area (VMA) if the Buffer Object (BO) is too large. This can lead to use-after-free conditions when munmap() unmaps only the VMA region and not the additional mappings. To mitigate this, the system must check the remaining size of the VMA before remapping and truncate the remapped length if sg->length is too large.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.