CVE-2026-64254
Full vulnerability record from the local CVENow database.
Description
In the Linux kernel, the following vulnerability has been resolved: NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR When BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, the module teardown path ends up calling pci_iounmap() on the same iomem with some offset, which is unnecessary and triggers a kernel warning like the following: Trying to vunmap() nonexistent vm area (0000000069a5ffe8) WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937 [...] Call trace: vunmap+0x58/0x68 (P) iounmap+0x34/0x48 pci_iounmap+0x2c/0x40 ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf] pci_device_remove+0x48/0xf8 device_remove+0x50/0x88 device_release_driver_internal+0x1c8/0x228 driver_detach+0x50/0xb0 bus_remove_driver+0x74/0x100 driver_unregister+0x34/0x68 pci_unregister_driver+0x34/0xa0 ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf] [...] Fix it by unmapping only when PEER_SPAD and CONFIG use difference bars.
Severity
MEDIUM
CVSS score
5.5
(v3.1)
Vulnerability status
Analyzed
Source identifier
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Published
2026-07-24 16:16:55.130000
Last modified
2026-11-08 16:10:00.183000
View original CVE JSON
{
"id": "CVE-2026-64254",
"sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"published": "2026-07-24T16:16:55.130",
"lastModified": "2026-11-08T16:10:00.183",
"vulnStatus": "Analyzed",
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nNTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR\n\nWhen BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, the module teardown\npath ends up calling pci_iounmap() on the same iomem with some offset,\nwhich is unnecessary and triggers a kernel warning like the following:\n\n Trying to vunmap() nonexistent vm area (0000000069a5ffe8)\n WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937\n [...]\n Call trace:\n vunmap+0x58/0x68 (P)\n iounmap+0x34/0x48\n pci_iounmap+0x2c/0x40\n ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf]\n pci_device_remove+0x48/0xf8\n device_remove+0x50/0x88\n device_release_driver_internal+0x1c8/0x228\n driver_detach+0x50/0xb0\n bus_remove_driver+0x74/0x100\n driver_unregister+0x34/0x68\n pci_unregister_driver+0x34/0xa0\n ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf]\n [...]\n\nFix it by unmapping only when PEER_SPAD and CONFIG use difference bars."
},
{
"lang": "es",
"value": "En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta:\n\nNTB: epf: Evitar pci_iounmap() con desplazamiento cuando PEER_SPAD y CONFIG comparten BAR\n\nCuando BAR_PEER_SPAD y BAR_CONFIG comparten una BAR PCI, la ruta de desmontaje del módulo termina llamando a pci_iounmap() en el mismo iomem con algún desplazamiento, lo cual es innecesario y dispara una advertencia del kernel como la siguiente:\n\n Intentando vunmap() un área de vm inexistente (0000000069a5ffe8)\n ADVERTENCIA: mm/vmalloc.c:3470 en vunmap+0x58/0x68, CPU#5: modprobe/2937\n [...]\n Traza de llamada:\n vunmap+0x58/0x68 (P)\n iounmap+0x34/0x48\n pci_iounmap+0x2c/0x40\n ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf]\n pci_device_remove+0x48/0xf8\n device_remove+0x50/0x88\n device_release_driver_internal+0x1c8/0x228\n driver_detach+0x50/0xb0\n bus_remove_driver+0x74/0x100\n driver_unregister+0x34/0x68\n pci_unregister_driver+0x34/0xa0\n ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf]\n [...]\n\nSe soluciona desmapeando solo cuando PEER_SPAD y CONFIG usan barras diferentes."
}
],
"affected": [
{
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"affectedData": [
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "unaffected",
"programFiles": [
"drivers/ntb/hw/epf/ntb_hw_epf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4",
"lessThan": "eb47b9bffd07a47b84910847cb5ea066ce184055",
"versionType": "git",
"status": "affected"
},
{
"version": "e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4",
"lessThan": "06f6dd2ff2bd07eaf7178a807407ff27e85122b4",
"versionType": "git",
"status": "affected"
},
{
"version": "e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4",
"lessThan": "a4be4a1308f02bff79a30eea2d04ead5b63685f2",
"versionType": "git",
"status": "affected"
},
{
"version": "e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4",
"lessThan": "81371dbd23601f67f01372817fdbab42c5601e43",
"versionType": "git",
"status": "affected"
},
{
"version": "e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4",
"lessThan": "9764a786ba98db58f0725913c369e721253aba33",
"versionType": "git",
"status": "affected"
},
{
"version": "e75d5ae8ab88b7ffb3d1d56124b003f3555f74b4",
"lessThan": "d876153680e3d721d385e554def919bce3d18c74",
"versionType": "git",
"status": "affected"
}
]
},
{
"vendor": "Linux",
"product": "Linux",
"defaultStatus": "affected",
"programFiles": [
"drivers/ntb/hw/epf/ntb_hw_epf.c"
],
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
"versions": [
{
"version": "6.0",
"status": "affected"
},
{
"version": "0",
"lessThan": "6.0",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.1.177",
"lessThanOrEqual": "6.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.6.144",
"lessThanOrEqual": "6.6.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.12.95",
"lessThanOrEqual": "6.12.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "6.18.38",
"lessThanOrEqual": "6.18.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.1.3",
"lessThanOrEqual": "7.1.*",
"versionType": "semver",
"status": "unaffected"
},
{
"version": "7.2",
"lessThanOrEqual": "*",
"versionType": "original_commit_for_fix",
"status": "unaffected"
}
]
}
]
}
],
"metrics": {
"cvssMetricV31": [
{
"source": "[email protected]",
"type": "Primary",
"cvssData": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"attackVector": "LOCAL",
"attackComplexity": "LOW",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"availabilityImpact": "HIGH"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
]
},
"weaknesses": [
{
"source": "[email protected]",
"type": "Primary",
"description": [
{
"lang": "en",
"value": "CWE-617"
}
]
}
],
"configurations": [
{
"nodes": [
{
"operator": "OR",
"negate": false,
"cpeMatch": [
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.0",
"versionEndExcluding": "6.1.177",
"matchCriteriaId": "E1C3142A-8469-4087-A10A-726FF6961047"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.2",
"versionEndExcluding": "6.6.144",
"matchCriteriaId": "C8AD3BC8-C843-423C-B9DB-CB52F67F578E"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.7",
"versionEndExcluding": "6.12.95",
"matchCriteriaId": "4E206B86-E0E3-4394-A93F-39F2D50A8AA8"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.13",
"versionEndExcluding": "6.18.38",
"matchCriteriaId": "FA591B28-5D62-449E-BDBE-3C9391BF070A"
},
{
"vulnerable": true,
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
"versionStartIncluding": "6.19",
"versionEndExcluding": "7.1.3",
"matchCriteriaId": "9526B150-E2B3-4C6F-8AE5-1AF92B75AD9E"
}
]
}
]
}
],
"references": [
{
"url": "https://git.kernel.org/stable/c/06f6dd2ff2bd07eaf7178a807407ff27e85122b4",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/81371dbd23601f67f01372817fdbab42c5601e43",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/9764a786ba98db58f0725913c369e721253aba33",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/a4be4a1308f02bff79a30eea2d04ead5b63685f2",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/d876153680e3d721d385e554def919bce3d18c74",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
},
{
"url": "https://git.kernel.org/stable/c/eb47b9bffd07a47b84910847cb5ea066ce184055",
"source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
"tags": [
"Patch"
]
}
]
}