Skip to main content

Linux Kernel EUVDEUVD-2026-45626

| CVE-2026-64053 HIGH
2026-07-19 Linux GHSA-xhqx-5f69-qrg5
Information Disclosure Linux
7.8
CVSS 3.1 · Vendor: Linux
Share

Severity by source

Vendor (Linux) PRIMARY
7.8 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
5.3 MEDIUM

Local low-priv attacker needs a non-default integrity-capable block device and specific WRITE path (AC:H); primary impact is OOB kernel-memory disclosure (C:H) with possible instability (A:L), no clear integrity impact.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:L
4.0 AV:L/AC:H/AT:N/PR:L/UI:N/VC:H/VI:N/VA:L/SC:N/SI:N/SA:N
SUSE
HIGH
qualitative
Red Hat
7.0 MEDIUM
qualitative

Primary rating from Vendor (Linux).

CVSS VectorVendor: Linux

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

5
Analysis Generated
Jul 20, 2026 - 17:08 vuln.today
CVSS changed
Jul 20, 2026 - 15:22 NVD
7.8 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:39 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:39 cve.org
HIGH 7.8

DescriptionCVE.org

In the Linux kernel, the following vulnerability has been resolved:

block: don't overwrite bip_vcnt in bio_integrity_copy_user()

bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h read past the bip_vec[] flex array. On READ the read is in bounds but lands on a saved user bvec instead of the bounce.

The line was added for split propagation, but bio_integrity_clone() doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER.

AnalysisAI

Out-of-bounds kernel memory read in the Linux kernel block layer (block integrity subsystem) stems from bio_integrity_copy_user() overwriting bip_vcnt with nr_vecs after bio_integrity_add_page() had already set it to 1 for the bounce segment. On WRITE this breaks the bip_vcnt <= bip_max_vcnt invariant (bip_max_vcnt is 1), causing gap-merge checks in block/blk.h to read past the bip_vec[] flex array; on READ, in-bounds access lands on a saved user bvec instead of the bounce. A local low-privileged user issuing I/O with user-supplied integrity metadata can trigger information disclosure and instability; there is no public exploit identified at time of analysis and EPSS is very low (0.17%, 6th percentile).

Technical ContextAI

The affected code is the Linux block layer's integrity payload handling (bio integrity / BIP), which supports T10 Protection Information (DIF/DIX) end-to-end data integrity metadata for block devices. bio_integrity_copy_user() creates a bounce buffer for user-provided integrity data and calls bio_integrity_add_page(), which correctly sets bip_vcnt to 1 for the single bounce segment; a subsequent line then overwrote bip_vcnt with nr_vecs. Because bip_max_vcnt is 1 for the WRITE bounce case, the resulting bip_vcnt > bip_max_vcnt condition invalidates the invariant relied upon by the gap-merge logic in block/blk.h, which then indexes past the end of the bip_vec[] flexible-array member - a classic out-of-bounds read (CWE-125, though the CVE lists CWE as N/A). The offending line had been added to propagate split state, but the commit message notes bio_integrity_clone() does not copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER, so the line served no correct purpose.

RemediationAI

Vendor-released patch: update to a fixed stable kernel - 6.12.92, 6.18.34, 7.0.11, or 7.1 (or your distribution's corresponding backport that includes the upstream fix). The fix removes the erroneous bip_vcnt = nr_vecs assignment in bio_integrity_copy_user() so bio_integrity_add_page()'s bip_vcnt = 1 for the bounce segment is preserved; the authoritative commits are at https://git.kernel.org/stable/c/d18160c9525c63c203656fefd847e94b538cd4a4 and the three sibling commits (0d48654af4d1390c888389206cc13b51b82c30e6, 066be1439593a381b1a29663becfcfe0c92363e7, 637ad3a56a3b889527d1dacea6fea2a8bd648140). If immediate patching is not possible, the practical compensating control is to avoid workloads that submit user-supplied integrity metadata on integrity-capable (T10 PI/DIX) block devices and to restrict local access to such devices; disabling or not enabling block integrity passthrough removes the vulnerable code path, at the cost of losing end-to-end data-integrity protection for storage that relies on it. Standard local-attack-surface reduction (limiting untrusted local user accounts and containers with block-device access) further reduces exposure.

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Important
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Affected
SUSE Linux Enterprise High Availability Extension 16.0 Affected

Share

EUVD-2026-45626 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy