{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2026-64053","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2026-07-19T07:54:57.029Z","datePublished":"2026-07-19T15:39:35.854Z","dateUpdated":"2026-07-20T13:42:51.761Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-07-20T13:42:51.761Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: don't overwrite bip_vcnt in bio_integrity_copy_user()\n\nbio_integrity_add_page() already sets bip_vcnt to 1 for the bounce\nsegment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt\non WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h\nread past the bip_vec[] flex array. On READ the read is in bounds\nbut lands on a saved user bvec instead of the bounce.\n\nThe line was added for split propagation, but bio_integrity_clone()\ndoesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","baseScore":7.8,"baseSeverity":"HIGH"}}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/bio-integrity.c"],"versions":[{"version":"3991657ae7074c3c497bf095093178bed37ea1b4","lessThan":"d18160c9525c63c203656fefd847e94b538cd4a4","status":"affected","versionType":"git"},{"version":"3991657ae7074c3c497bf095093178bed37ea1b4","lessThan":"0d48654af4d1390c888389206cc13b51b82c30e6","status":"affected","versionType":"git"},{"version":"3991657ae7074c3c497bf095093178bed37ea1b4","lessThan":"066be1439593a381b1a29663becfcfe0c92363e7","status":"affected","versionType":"git"},{"version":"3991657ae7074c3c497bf095093178bed37ea1b4","lessThan":"637ad3a56a3b889527d1dacea6fea2a8bd648140","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["block/bio-integrity.c"],"versions":[{"version":"6.11","status":"affected"},{"version":"0","lessThan":"6.11","status":"unaffected","versionType":"semver"},{"version":"6.12.92","lessThanOrEqual":"6.12.*","status":"unaffected","versionType":"semver"},{"version":"6.18.34","lessThanOrEqual":"6.18.*","status":"unaffected","versionType":"semver"},{"version":"7.0.11","lessThanOrEqual":"7.0.*","status":"unaffected","versionType":"semver"},{"version":"7.1","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.12.92"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"6.18.34"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.0.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.11","versionEndExcluding":"7.1"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/d18160c9525c63c203656fefd847e94b538cd4a4"},{"url":"https://git.kernel.org/stable/c/0d48654af4d1390c888389206cc13b51b82c30e6"},{"url":"https://git.kernel.org/stable/c/066be1439593a381b1a29663becfcfe0c92363e7"},{"url":"https://git.kernel.org/stable/c/637ad3a56a3b889527d1dacea6fea2a8bd648140"}],"title":"block: don't overwrite bip_vcnt in bio_integrity_copy_user()","x_generator":{"engine":"bippy-1.2.0"}}}}