CVE-2026-64053: block: don't overwrite bip_vcnt in bio_integrity_copy_user()
In the Linux kernel, the following vulnerability has been resolved:
block: don't overwrite bipvcnt in biointegritycopyuser()
biointegrityaddpage() already sets bipvcnt to 1 for the bounce segment. Overwriting it with nrvecs breaks bipvcnt <= bipmaxvcnt on WRITE (bipmaxvcnt is 1), so the gap-merge checks in block/blk.h read past the bipvec[] flex array. On READ the read is in bounds but lands on a saved user bvec instead of the bounce.
The line was added for split propagation, but biointegrityclone() doesn't copy bipvcnt and BIPCLONEFLAGS excludes BIPCOPYUSER.
Affected Software
Remediation
Event History
Frequently Asked Questions
What conditions are needed to trigger this issue?
Exploitation requires local access and low privileges; no user interaction is required. The vulnerable path involves bio integrity handling in bio_integrity_copy_user(), with distinct faulty behavior on read and write operations.
Are both read and write operations affected in the same way?
No. On writes, an invalid bip_vcnt value can cause gap-merge checks to read past the bip_vec[] flexible array. On reads, the access remains in bounds but uses a saved user bvec rather than the bounce segment.
What should administrators do?
Apply the available Linux kernel patch. The provided stable references identify patched commits for this issue.