CVE-2026-64053

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-64053

Key Details

CVE	CVE-2026-64053
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

block: don't overwrite bip_vcnt in bio_integrity_copy_user()

bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce

segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt

on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h

read past the bip_vec[] flex array. On READ the read is in bounds

but lands on a saved user bvec instead of the bounce.

The line was added for split propagation, but bio_integrity_clone()

doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER. (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-64053
CVE	https://www.cve.org/CVERecord?id=CVE-2026-64053

Source

Reference

NVD

CVE