CVE-2026-64052

A flaw was found in the Linux kernel's bio-integrity module. The bio_integrity_map_user() function does not correctly handle partially pinned user pages, which can occur when pin_user_pages_fast() returns fewer pages than requested. This oversight leads to a null-pointer dereference when attempting to access an unpinned page address. A local user could exploit this vulnerability to trigger a general protection fault, resulting in a system crash and a denial of service.

This vulnerability is rated as Moderate impact because exploitation requires local access and is limited to causing a denial of service through an operating system crash, with no risk to data integrity or confidentiality. Triggering the condition necessitates sending block or passthrough I/O requests with user-mapped integrity metadata, which is typically restricted to privileged accounts in standard enterprise environments. Earlier platforms, including Red Hat Enterprise Linux 7 and 8, lack the vulnerable subsystem implementation and are unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.