CVE-2026-64051: accel/qaic: Add overflow check to remap_pfn_range during mmap
In the Linux kernel, the following vulnerability has been resolved:
accel/qaic: Add overflow check to remappfnrange during mmap
The call to remappfnrange in qaicgemobjectmmap is susceptible to (re)mapping beyond the VMA if the BO is too large. This can cause use after free issues when munmap() unmaps only the VMA region and not the additional mappings. To prevent this, check the remaining size of the VMA before remapping and truncate the remapped length if sg->length is too large.
[jhugo: fix braces from checkpatch --strict]
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
In qaic_gem_object_mmap, before calling remap_pfn_range, check the remaining size of the VMA and truncate the remapped length if sg->length would exceed the available VMA space (prevent remapping beyond the VMA when the BO is too large).
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access and low privileges are required. No user interaction is required.
Which systems are exposed?
Systems running the Linux kernel with the accel/qaic component are the relevant exposure population. The issue occurs in qaic_gem_object_mmap when a buffer object is large enough that remap_pfn_range can map beyond the VMA.
What is the impact if exploitation succeeds?
Mapping beyond the VMA can leave additional mappings after munmap() removes only the VMA region, causing a use-after-free condition. The reported CVSS impact includes high confidentiality, integrity, and availability impact.
What does the available fix do?
The fix checks the VMA's remaining size before calling remap_pfn_range and truncates the remapped length when sg->length is too large. Stable kernel commits are referenced for the resolved issue.