Linux Kernel CVE-2026-64124

The affected component is Linux 'devmem TCP', a zero-copy networking feature that maps GPU/NIC device memory into the network stack via dma-buf. When a dma-buf is bound, net_devmem_bind_dmabuf() builds a tx_vec array whose length is dmabuf->size / PAGE_SIZE and populates a gen_pool-backed region of net_iov (niov) descriptors, one per page. Two implicit assumptions are violated: (1) net_devmem_get_niov_at() only checks virt_addr < dmabuf->size before computing tx_vec[virt_addr / PAGE_SIZE], so a non-page-multiple size leaves a reachable offset that indexes one element past the array; and (2) owner->area.num_niovs is set to len / PAGE_SIZE while gen_pool_add_owner() covers the full byte length, so any non-final scatter-gather entry whose length is not a page multiple desyncs the niov count from the pool for every subsequent SG on both RX and TX paths. The dma-buf framework explicitly does not guarantee page-aligned sizes, so the bind path must enforce the alignment its own indexing assumes. No CWE was assigned (N/A), but the behavior maps to CWE-125 (out-of-bounds read) combined with CWE-129 (improper validation of array index) and CWE-20 (missing input validation).