{"id":"CVE-2026-64052","title":"block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\nblock: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()\n\npin_user_pages_fast() can partially succeed and return the number of\npages that were actually pinn…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 < 77c059f41e9395793917d067476f549a911d77d3","Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 < 76410790f1491c8e06a451045ae223a61c652455","Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 < 8fa244738641d95ea4d70e6f9a62778bba42a5b7","Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 < 8582792cf23b3d94674d4d838f7cde9a28d0fcaf","Linux 6.8"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:29:22.715121Z"},"published":"2026-07-19","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:34:24.903Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64052","references":[{"url":"https://git.kernel.org/stable/c/77c059f41e9395793917d067476f549a911d77d3"},{"url":"https://git.kernel.org/stable/c/76410790f1491c8e06a451045ae223a61c652455"},{"url":"https://git.kernel.org/stable/c/8fa244738641d95ea4d70e6f9a62778bba42a5b7"},{"url":"https://git.kernel.org/stable/c/8582792cf23b3d94674d4d838f7cde9a28d0fcaf"}],"tags":["cve.org"],"epss":0.00122,"epssPercentile":0.01985,"ingestedAt":"2026-11-06T16:57:43.239Z","slug":"CVE-2026-64052","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\nblock: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()\n\npin_user_pages_fast() can partially succeed and return the number of\npages that were actually pinned. However, the bio_integrity_map_user()\ndoes not handle this partial pinning. This leads to a general protection\nfault since bvec_from_pages() dereferences an unpinned page address,\nwhich is 0.\n\nTo fix this, add a check to verify that all requested memory is pinned.\nIf partial pinning occurs, unpin the memory and return -EFAULT.\n\nKernel Oops:\n\nOops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI\nKASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]\nCPU: 0 UID: 0 PID: 1061 Comm: nvme-passthroug Not tainted 7.0.0-11783-g90957f9314e8-dirty #16 PREEMPT(lazy)\nHardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014\nRIP: 0010:bio_integrity_map_user.cold+0x1b0/0x9d6\n\n## Affected\n\n- `Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 < 77c059f41e9395793917d067476f549a911d77d3`\n- `Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 < 76410790f1491c8e06a451045ae223a61c652455`\n- `Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 < 8fa244738641d95ea4d70e6f9a62778bba42a5b7`\n- `Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 < 8582792cf23b3d94674d4d838f7cde9a28d0fcaf`\n- `Linux 6.8`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}