---
id: CVE-2026-64052
title: 'block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()

  pin_user_pages_fast() can partially succeed and return the number of
  pages that were actually pinn…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 <
    77c059f41e9395793917d067476f549a911d77d3
  - >-
    Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 <
    76410790f1491c8e06a451045ae223a61c652455
  - >-
    Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 <
    8fa244738641d95ea4d70e6f9a62778bba42a5b7
  - >-
    Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 <
    8582792cf23b3d94674d4d838f7cde9a28d0fcaf
  - Linux 6.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:29:22.715121Z'
published: '2026-07-19'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:24.903Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64052'
references:
  - url: 'https://git.kernel.org/stable/c/77c059f41e9395793917d067476f549a911d77d3'
  - url: 'https://git.kernel.org/stable/c/76410790f1491c8e06a451045ae223a61c652455'
  - url: 'https://git.kernel.org/stable/c/8fa244738641d95ea4d70e6f9a62778bba42a5b7'
  - url: 'https://git.kernel.org/stable/c/8582792cf23b3d94674d4d838f7cde9a28d0fcaf'
tags:
  - cve.org
epss: 0.00122
epssPercentile: 0.01985
ingestedAt: '2026-11-06T16:57:43.239Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

block: bio-integrity: Fix null-ptr-deref in bio_integrity_map_user()

pin_user_pages_fast() can partially succeed and return the number of
pages that were actually pinned. However, the bio_integrity_map_user()
does not handle this partial pinning. This leads to a general protection
fault since bvec_from_pages() dereferences an unpinned page address,
which is 0.

To fix this, add a check to verify that all requested memory is pinned.
If partial pinning occurs, unpin the memory and return -EFAULT.

Kernel Oops:

Oops: general protection fault, probably for non-canonical address 0xdffffc0000000001: 0000 [#1] SMP KASAN NOPTI
KASAN: null-ptr-deref in range [0x0000000000000008-0x000000000000000f]
CPU: 0 UID: 0 PID: 1061 Comm: nvme-passthroug Not tainted 7.0.0-11783-g90957f9314e8-dirty #16 PREEMPT(lazy)
Hardware name: QEMU Standard PC (i440FX + PIIX, 1996), BIOS rel-1.17.0-0-gb52ca86e094d-prebuilt.qemu.org 04/01/2014
RIP: 0010:bio_integrity_map_user.cold+0x1b0/0x9d6

## Affected

- `Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 < 77c059f41e9395793917d067476f549a911d77d3`
- `Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 < 76410790f1491c8e06a451045ae223a61c652455`
- `Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 < 8fa244738641d95ea4d70e6f9a62778bba42a5b7`
- `Linux >= 492c5d455969fc2e829f26ed4c83487b068f0dd7 < 8582792cf23b3d94674d4d838f7cde9a28d0fcaf`
- `Linux 6.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.