CVE-2026-64124

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the net devmem bind dmabuf() function where the system trusts dmabuf->size and sg dma len() to be multiples of PAGE SIZE without verification. This leads to two primary problems: first, if the size is not page-aligned, sendmsg() can perform an out-of-bounds read on the tx vec array. Second, a non-page-multiple scatter-gather (SG) length causes a desynchronization between owner->area.num niovs and the general pool region for subsequent SG entries in both RX and TX directions. DMA-buf does not inherently require page-aligned sizes, meaning the bind path must explicitly enforce these constraints to prevent indexing errors.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.