EUVD-2026-76496
GHSA-rh46-v7ch-v9qg
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local access with standard user privileges sufficient to submit I/O; no interaction required; full kernel memory-safety triad if corruption primitive is achieved.
Primary rating from Vendor (Linux).
CVSS VectorVendor: Linux
Lifecycle Timeline
6DescriptionCVE.org
In the Linux kernel, the following vulnerability has been resolved:
block: validate user space vectors during extraction
The bio-based drivers don't necessarily check the alignment split, and stacking block drivers don't always handle a misalignment detected after submitting the bio. Validate user vectors against the device's dma_alignment as the bio is built from the iov_iter, rejecting misaligned early with -EINVAL.
AnalysisAI
Missing DMA alignment validation in the Linux kernel block layer allows a local unprivileged user to submit misaligned I/O vectors that bypass per-device alignment checks during bio construction from iov_iter, potentially triggering memory corruption, data leakage, or kernel crashes. Bio-based drivers lack alignment-split checks and stacking block drivers may silently mis-handle misalignment detected only after bio submission, making the window for exploitation broader than a single driver path. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a local account on the target system with the ability to submit direct I/O to a block device - either by opening a raw block device node with appropriate permissions, or indirectly through a filesystem that permits O_DIRECT. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) accurately reflects local exploitation by a standard user with no user interaction and full memory-safety impact if a corruption primitive is achieved. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade to Linux kernel 7.2.4 or 7.3-rc1, which include the validated fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Linux systems in your infrastructure and document their kernel versions. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today