Skip to main content

Linux Kernel NTB CVE-2026-64254

| EUVDEUVD-2026-48663 MEDIUM
Reachable Assertion (CWE-617)
2026-07-24 Linux GHSA-c496-vr74-8pgf
Information Disclosure Linux
5.5
CVSS 3.1 · NVD
Share

Severity by source

NVD PRIMARY
5.5 MEDIUM
AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
vuln.today AI
4.4 MEDIUM

Module removal requires CAP_SYS_MODULE (root equivalent), warranting PR:H over the official PR:L; no confidentiality or integrity impact present.

3.1 AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
4.0 AV:L/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
MEDIUM
qualitative
Red Hat
5.5 LOW
qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 12, 2026 - 16:19 vuln.today
CVSS changed
Aug 12, 2026 - 16:07 NVD
5.5 (MEDIUM)
Patch available
Jul 24, 2026 - 17:48 EUVD
CVE Published
Jul 24, 2026 - 15:31 nvd
MEDIUM 5.5
CVE Published
Jul 24, 2026 - 15:31 cve.org
UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR

When BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, the module teardown path ends up calling pci_iounmap() on the same iomem with some offset, which is unnecessary and triggers a kernel warning like the following:

Trying to vunmap() nonexistent vm area (0000000069a5ffe8) WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937 [...] Call trace: vunmap+0x58/0x68 (P) iounmap+0x34/0x48 pci_iounmap+0x2c/0x40 ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf] pci_device_remove+0x48/0xf8 device_remove+0x50/0x88 device_release_driver_internal+0x1c8/0x228 driver_detach+0x50/0xb0 bus_remove_driver+0x74/0x100 driver_unregister+0x34/0x68 pci_unregister_driver+0x34/0xa0 ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf] [...]

Fix it by unmapping only when PEER_SPAD and CONFIG use difference bars.

AnalysisAI

Kernel availability degradation in the Linux kernel ntb_hw_epf driver occurs during module teardown when BAR_PEER_SPAD and BAR_CONFIG share a single PCI BAR, causing ntb_epf_pci_remove() to call pci_iounmap() on an offset address that was never independently registered as a vm_area. Systems running Linux 6.0 through at least 6.18.37 with the ntb_hw_epf module loaded under this BAR-sharing configuration will generate a kernel warning ('Trying to vunmap() nonexistent vm area') upon driver removal. No public exploit exists and EPSS probability is 0.16% (6th percentile), consistent with an availability-only defect requiring specific hardware topology and local privilege to trigger.

Technical ContextAI

The Non-Transparent Bridge Endpoint Function (NTB EPF) driver (ntb_hw_epf) is a Linux kernel subsystem enabling PCIe endpoint devices to participate in NTB topologies. PCI BARs (Base Address Registers) expose memory-mapped regions for CONFIG and PEER_SPAD functionality. When both regions are assigned the same physical BAR, the driver shares the iomem pointer internally but incorrectly treats the two mappings as independent during teardown: ntb_epf_pci_remove() calls pci_iounmap() on the PEER_SPAD address - which is the same base mapping plus an offset - as if it were a standalone region, triggering the kernel's vmalloc assertion because that offset pointer was never registered as its own vm_area. CWE-617 (Reachable Assertion) applies because the kernel vunmap() path contains an internal sanity check that fires when presented with a pointer not tracked in the vmalloc tree. The affected CPE is cpe:2.3:a:linux:linux:*:*:*:*:*:*:*:*, introduced at commit e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4 and spanning the 6.x and 7.x stable series.

RemediationAI

The primary fix is upgrading to a patched Linux kernel stable release: 6.1.177, 6.6.144, 6.12.95, 6.18.38, 7.1.3, or 7.2-rc1. Relevant upstream commits are available at https://git.kernel.org/stable/c/d876153680e3d721d385e554def919bce3d18c74 (and parallel commits eb47b9bffd07a47b84910847cb5ea066ce184055, 06f6dd2ff2bd07eaf7178a807407ff27e85122b4, a4be4a1308f02bff79a30eea2d04ead5b63685f2, 81371dbd23601f67f01372817fdbab42c5601e043, 9764a786ba98db58f0725913c369e721253aba33) for the respective branches. If an immediate kernel upgrade is not feasible, blacklisting the ntb_hw_epf module by adding 'blacklist ntb_hw_epf' to /etc/modprobe.d/ eliminates the vulnerable code path entirely; the trade-off is complete loss of NTB PCIe endpoint functionality. A hardware-level alternative is ensuring the platform firmware assigns PEER_SPAD and CONFIG to distinct PCI BARs, bypassing the shared-BAR code path without disabling the driver - but this requires firmware or platform reconfiguration that may not be possible on all hardware.

Same weakness CWE-617 – Reachable Assertion

View all
CVE-2025-15684 MEDIUM POC
5.5
CVE-2016-8864 HIGH
7.5
CVE-2020-12417 HIGH POC
8.8
CVE-2020-6623 HIGH POC
8.8
CVE-2020-6619 HIGH POC
8.8
CVE-2020-6617 HIGH POC
8.8
CVE-2023-37023 HIGH POC
8.6
CVE-2023-37021 HIGH POC
8.6

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
openSUSE Tumbleweed Fixed
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected

Share

CVE-2026-64254 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy