LiveActive security incident?Get immediate response
CVE Record

CVE-2026-64052: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()

In the Linux kernel, the following vulnerability has been resolved: block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user() pin_user_pages_fast() can partially succeed and return the number of pages that were actually pinned. However, the bio_integrity_map_user() does not handle this partial pinning. This leads to a general protection fault since bvec_from_pages() dereferences an unpinned page address, which is 0. To fix this, add a check to verify that all requested memory is pinned. If partial pinning occurs, unpin the memory and return -EFAULT. Kernel Oops: Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f] CPU: 0 UID: 0 PID: 1061 Comm: nvme-passthroug Not tainted 7.0.0-11783-g90957f9314e8-dirty #16 PREEMPT(lazy) Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014 RIP: 0010:bio_integrity_map_user.cold+0x1b0/0x9d6

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysisunknown

Security readout for executives and security teams

Plain-English summary

This is a Linux kernel flaw that can crash the kernel when a memory-pinning operation only partly succeeds. The source describes a null pointer dereference in block integrity handling, producing a kernel Oops. Business impact is most clearly availability risk; severity and exploitability are not yet rated in the provided sources.

Executive priority

Treat this as a kernel availability issue requiring prompt tracking, not emergency response based on current evidence. Prioritize internet-facing infrastructure only if it also exposes relevant local or storage-control paths. Await vendor severity and package advisories before broad disruption.

Technical view

bio_integrity_map_user() failed to handle partial success from pin_user_pages_fast(). If fewer pages were pinned than requested, bvec_from_pages() could dereference an unpinned page address of zero, causing a general protection fault. The fix verifies all requested memory was pinned, unpins partial results, and returns -EFAULT.

Likely exposure

Exposure is limited to Linux kernels listed as affected in the CVE source, including version markers 6.8, 6.12.92, 6.18.34, 7.0.11, and 7.1. The bundle does not identify distributions, appliances, or cloud images that ship vulnerable builds.

Exploitation context

The source bundle shows no KEV listing and no cited evidence of active exploitation. It includes a kernel Oops from a QEMU test system involving an nvme-passthrough process, but does not provide a real-world exploitation report or complete attack prerequisites.

Researcher notes

Evidence supports a partial pinning error in bio_integrity_map_user(), fixed by rejecting incomplete pin_user_pages_fast() results. The bundle lacks CVSS, CWE, distribution mapping, and exploit prerequisites. Analysis should stay constrained to Linux kernel block integrity code and the referenced stable commits.

Mitigation direction

  • Apply Linux stable updates containing the referenced fix commits when available.
  • Check distribution or vendor kernel advisories for packaged remediation guidance.
  • Prioritize kernels listed as affected in the CVE record.
  • Track storage-heavy or passthrough-capable systems for earlier remediation.
  • Avoid claiming exposure for downstream products without vendor confirmation.

Validation and detection

  • Inventory Linux kernel versions across production and staging systems.
  • Compare running kernels against the affected version markers in the CVE record.
  • Check whether vendor kernels include one of the referenced stable commits.
  • Review kernel logs for unexplained Oops or general protection faults.
  • Confirm patched systems return normal storage workload behavior after update.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2026-64052 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
3Timeline events
0ADP providers
5Source links

Vulnerability timeline

Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.

  1. CVE reservedCVE Program

    The CVE ID was reserved by the assigning CNA.

  2. CVE publishedCVE Program

    The CVE record was published.

  3. CVE updatedCVE Program

    The CVE record metadata indicates this as the latest update time.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
LinuxLinux492c5d455969fc2e829f26ed4c83487b068f0dd7, 492c5d455969fc2e829f26ed4c83487b068f0dd7, 492c5d455969fc2e829f26ed4c83487b068f0dd7, 492c5d455969fc2e829f26ed4c83487b068f0dd7unaffected
LinuxLinux6.8, 0, 6.12.92, 6.18.34, 7.0.11, 7.1affected
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.