CVE-2026-64053

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the bio integrity copy user() function where the bip vcnt variable is incorrectly overwritten. Because bio integrity add page() already sets bip vcnt to 1 for the bounce segment, overwriting it with nr vecs violates the bip vcnt <= bip max vcnt condition during WRITE operations. This causes gap-merge checks in block/blk.h to read beyond the bip vec[] flex array. During READ operations, the read remains in bounds but incorrectly accesses a saved user bvec instead of the bounce segment.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.