CVE-2026-64053 block: don't overwrite bip_vcnt in bio_integrity_copy_user()
A logic error in the Linux kernel block layer causes out-of-bounds reads, potentially leading to memory corruption or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64053?
CVE-2026-64053 is a high-severity memory corruption vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
block: don't overwrite bip_vcnt in bio_integrity_copy_user()
bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h read past the bip_vec[] flex array. On READ the read is in bounds but lands on a saved user bvec instead of the bounce.
The line was added for split propagation, but bio_integrity_clone() doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER.
Weakness: CWE-125
Which versions are affected by CVE-2026-64053?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64053?
Apply the vendor's patch.
Upgrade to the fixed version. Memory-safe languages, compiler hardening and fuzzing prevent most new cases. More about Memory corruption.
Is CVE-2026-64053 being exploited?
There is no known exploitation of CVE-2026-64053 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64053, DEBIAN-CVE-2026-64053, GHSA-xhqx-5f69-qrg5, UBUNTU-CVE-2026-64053.