CVE-2026-64280fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
- 8.8HighCVSS base score
- 0.17%Exploitation in 30 daysEPSS · top 94% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is derived as length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes int nr_pages, causing implicit truncation if length is very large. Validate map.length at the ioctl entry point before calling afu_dma_map_region(), rejecting values whose page count exceeds INT_MAX.
Timeline
ID reserved
By Linux
- 6 days later
· 6 days later
Published
- 29 days later
· 29 days later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| LinuxCNA (assigner) | 3.1 | High8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 0.17% · top 94% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.8.
Affected products
- affected fa8dda1edef9ebc3af467c644c5533ac97171e12 – < 5352d488ce4ae5e8c68c080ad4c3a5f084ad5fbc
- affected fa8dda1edef9ebc3af467c644c5533ac97171e12 – < d7e787eee2ea619b6dbb98890472ee73daf2e7fd
- affected fa8dda1edef9ebc3af467c644c5533ac97171e12 – < a6a3884ff500f04f3088d6d09eec803cd35331a2
- affected fa8dda1edef9ebc3af467c644c5533ac97171e12 – < 16381bda90b261a656ded0568630c1b857b2ebc8
- affected fa8dda1edef9ebc3af467c644c5533ac97171e12 – < b50e6cd2395cde615f59b624819998d28c0668d6
- affected fa8dda1edef9ebc3af467c644c5533ac97171e12 – < 59070040fd12e0b78d7b4d341d9f9a183237c5ff
- affected fa8dda1edef9ebc3af467c644c5533ac97171e12 – < fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231
- affected fa8dda1edef9ebc3af467c644c5533ac97171e12 – < fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27
- affected 4.19
- unaffected < 4.19
- unaffected 5.10.266 – ≤ 5.10.*
- unaffected 5.15.217 – ≤ 5.15.*
- unaffected 6.1.184 – ≤ 6.1.*
- unaffected 6.6.148 – ≤ 6.6.*
- unaffected 6.12.101 – ≤ 6.12.*
- unaffected 6.18.39 – ≤ 6.18.*
- unaffected 7.1.4 – ≤ 7.1.*
- unaffected 7.2 – ≤ *
References
References8
- https://git.kernel.org/stable/c/5352d488ce4ae5e8c68c080ad4c3a5f084ad5fbc (opens in a new tab)
- https://git.kernel.org/stable/c/d7e787eee2ea619b6dbb98890472ee73daf2e7fd (opens in a new tab)
- https://git.kernel.org/stable/c/a6a3884ff500f04f3088d6d09eec803cd35331a2 (opens in a new tab)
- https://git.kernel.org/stable/c/16381bda90b261a656ded0568630c1b857b2ebc8 (opens in a new tab)
- https://git.kernel.org/stable/c/b50e6cd2395cde615f59b624819998d28c0668d6 (opens in a new tab)
- https://git.kernel.org/stable/c/59070040fd12e0b78d7b4d341d9f9a183237c5ff (opens in a new tab)
- https://git.kernel.org/stable/c/fb2c0eab51ae5b02d2bae7d67c2cfbec39b57231 (opens in a new tab)
- https://git.kernel.org/stable/c/fc3b071a7c8dc0f5d56defddf6e6fd5aaa3e1e27 (opens in a new tab)
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2026-48992 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2026-64280)Record last updated .