CVE-2026-64053

A flaw was found in the Linux kernel's block integrity subsystem. Incorrect handling of bio integrity vector counts in the bio_integrity_copy_user() function can lead to an out-of-bounds read during write operations. This vulnerability may allow a local attacker to cause a denial of service or potentially disclose sensitive information.

bio_integrity_copy_user() overwrites bip_vcnt with nr_vecs even though bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce segment. On WRITE this can make bip_vcnt greater than bip_max_vcnt and make block gap merge checks read past the bip_vec flex array. On READ the access stays in bounds but can use a saved user bvec instead of the bounce vector, which can cause incorrect integrity metadata handling. For the CVSS the PR:L is used because reliable triggering requires a local process with access to a block device path that accepts user integrity metadata, not full administrator privileges in all deployments. The issue is not network reachable. Impact is primarily local denial of service via invalid kernel memory access, with limited integrity or confidentiality risk considered in the paranoid score because an out-of-bounds read primitive is present.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.