CVE-2026-64280

fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()

State: Published
Severity: 8.8 High
Published: Jul 25, 2026
Updated: Aug 23, 2026
Reserved: Jul 19, 2026

Description

In the Linux kernel, the following vulnerability has been resolved:

fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()

afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is derived as length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes int nr_pages, causing implicit truncation if length is very large.

Validate map.length at the ioctl entry point before calling afu_dma_map_region(), rejecting values whose page count exceeds INT_MAX.

Scores

CVSS	Score	Vector	Source
3.1	8.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	fa8dda1edef9ebc3af467c644c5533ac97171e12 to before 5352d488ce4ae5e8c68c080ad4c3a5f084ad5fbcAffected fa8dda1edef9ebc3af467c644c5533ac97171e12 to before d7e787eee2ea619b6dbb98890472ee73daf2e7fdAffected fa8dda1edef9ebc3af467c644c5533ac97171e12 to before a6a3884ff500f04f3088d6d09eec803cd35331a2Affected fa8dda1edef9ebc3af467c644c5533ac97171e12 to before 16381bda90b261a656ded0568630c1b857b2ebc8Affected fa8dda1edef9ebc3af467c644c5533ac97171e12 to before b50e6cd2395cde615f59b624819998d28c0668d6Affected fa8dda1edef9ebc3af467c644c5533ac97171e12 to before 59070040fd12e0b78d7b4d341d9f9a183237c5ffAffected fa8dda1edef9ebc3af467c644c5533ac97171e12 to before fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231Affected fa8dda1edef9ebc3af467c644c5533ac97171e12 to before fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27Affected
LinuxLinux	4.19Affected before 4.19Not affected 5.10.266 through 5.10.Not affected 5.15.217 through 5.15.Not affected 6.1.184 through 6.1.Not affected 6.6.148 through 6.6.Not affected 6.12.101 through 6.12.Not affected 6.18.39 through 6.18.Not affected 7.1.4 through 7.1.*Not affected 7.2 and laterNot affected

Product

Versions

LinuxLinux

fa8dda1edef9ebc3af467c644c5533ac97171e12 to before 5352d488ce4ae5e8c68c080ad4c3a5f084ad5fbcAffected
fa8dda1edef9ebc3af467c644c5533ac97171e12 to before d7e787eee2ea619b6dbb98890472ee73daf2e7fdAffected
fa8dda1edef9ebc3af467c644c5533ac97171e12 to before a6a3884ff500f04f3088d6d09eec803cd35331a2Affected
fa8dda1edef9ebc3af467c644c5533ac97171e12 to before 16381bda90b261a656ded0568630c1b857b2ebc8Affected
fa8dda1edef9ebc3af467c644c5533ac97171e12 to before b50e6cd2395cde615f59b624819998d28c0668d6Affected
fa8dda1edef9ebc3af467c644c5533ac97171e12 to before 59070040fd12e0b78d7b4d341d9f9a183237c5ffAffected
fa8dda1edef9ebc3af467c644c5533ac97171e12 to before fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231Affected
fa8dda1edef9ebc3af467c644c5533ac97171e12 to before fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27Affected

LinuxLinux

4.19Affected
before 4.19Not affected
5.10.266 through 5.10.*Not affected
5.15.217 through 5.15.*Not affected
6.1.184 through 6.1.*Not affected
6.6.148 through 6.6.*Not affected
6.12.101 through 6.12.*Not affected
6.18.39 through 6.18.*Not affected
7.1.4 through 7.1.*Not affected
7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.