[CVE-2026-64280][MODERATE 7.0] fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()

[CVE-2026-64280][MODERATE 7.0] fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()

[AL-KERNEL]

CVE: CVE-2026-64280
Priority: MODERATE 7.0
AL-KERNEL base severity: MODERATE
KPANIC flag: YES
Patch: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
Commit: 59070040fd12e0b78d7b4d341d9f9a183237c5ff
Upstream patch: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=59070040fd12e0b78d7b4d341d9f9a183237c5ff
Original CVE announcement: https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-64280
Analysis date: Sat, 25 Jul 2026 10:52:21 -0400
ActionableScore: 6
ActionableScore lower bound: 5
Actionable bucket: Strong Important candidate / Actionable Moderate at minimum
Manual review required: YES

Summary:
A local DMA mapping length validation flaw in dfl-afu can truncate the page count passed to pin_user_pages_fast(), potentially creating inconsistent page pinning and DMA mapping state with DoS and possible confidentiality or integrity impact.

======================================================================
ABOUT THIS REPORT
======================================================================

The original Linux kernel CVE announcement for CVE-2026-64280 is available here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-64280

The original announcement does not normally provide a security severity
estimate, CVSS assessment, or enough information to determine whether the
reported kernel bug represents a practically relevant security issue.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin. It combines
an autonomous classifier with LLM-assisted technical analysis and a
separate ActionableScore mechanism.

The purpose of this report is to prioritize Linux kernel CVEs before
manual review, identify cases that require prompt investigation, and
support automatic closure of issues that are unlikely to have meaningful
security impact.

Published priority for this report: MODERATE 7.0
Manual review required: YES

A detailed explanation of the methodology and priority rules is included
at the end of this message.

======================================================================
AL-KERNEL CLASSIFICATION RESULT
======================================================================

CVE-2026-64280	MODERATE	CHECK WITH IMPACT FROM ORIG NN LOW	Maybe valid. Check manually. Hints by AL-KERNEL: The best (paranoid) CVSS is 'AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H';CWE-190;CWE-681;*CWE-20;Other CVSS 'AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H';BEST CVSS score: '7.8';DESCR 'A DMA mapping length validation bug in dfl-afu allows userspace to provide a very large 64-bit length through DFL_FPGA_PORT_DMA_MAP. The value is converted into a page count and later passed to pin_user_pages_fast, whose nr_pages argument is an int, so an oversized length can be truncated and make the DMA mapping state inconsistent with the originally requested range. For the CVSS the PR:L is used because a local process needs access to the FPGA DFL AFU device ioctl, which is lower than full administrator privileges when the device node is delegated to users or service accounts. The issue is not network reachable and requires local device access. Impact is at least local denial of service and, for the paranoid interpretation, may include confidentiality or integrity impact because the bug is in a DMA mapping path where incorrect page pinning can become a memory corruption candidate.';YES REQUIRES MANUAL CHECK; ,and ActionableScore result is Strong Important candidate / Actionable Moderate at minimum (with actual score 6)  SKIP CVE-2026-64280 UNKNOWN SKIP No affected files built, so skip this CVE NO  - - unknown 	MAYBE	SIMPLEFIX DMAorINTERRUPT  KPANIC INCREASED_TO_MODERATE_FROM_LOW_BASED_ON_GUESSCVSS	-	-	checked

======================================================================
ACTIONABLESCORE ANALYSIS
======================================================================

ActionableScore=6
ActionableScoreLower=5

## 1. ActionableScore

* Conservative score: 5
* Paranoid score: 6
* Final recommended bucket: **Strong Important candidate / Actionable Moderate at minimum**::

## 2. Signal breakdown

* Local unprivileged or low-privileged trigger: +1
  A local process with access to the DFL FPGA AFU device ioctl can submit DFL_FPGA_PORT_DMA_MAP requests.

* Memory corruption, weak or indirect corruption candidate: +1
  The bug is an integer truncation in a DMA page-pinning path. A 64-bit userspace length is converted to a page count and then passed to pin_user_pages_fast(), whose nr_pages parameter is int.

* Privileged kernel/device-management memory corruption path: +1
  The affected code is DMA-adjacent and controls page pinning for device access, which is more security-sensitive than ordinary validation-only bookkeeping.

* Confidentiality impact plausible: +1
  If page pinning and DMA mapping state become inconsistent, unintended memory exposure through device DMA is technically plausible, though not demonstrated by the patch alone.

* Integrity impact plausible: +1
  Incorrect DMA mapping state may allow writes outside the intended pinned range or otherwise corrupt memory/device state in a worst-case interpretation.

* Availability impact realistic: +1
  Invalid pinning or DMA mapping state can plausibly cause driver failure, kernel warnings, device malfunction, or crash.

* Rare hardware/subsystem exposure: -1
  This requires DFL FPGA AFU support and access to the relevant device node, so exposure is narrower than common syscall, networking, or filesystem paths.

Conservative total: 5
Paranoid total: 6

## 3. Reachability analysis

The trigger is local through DFL_FPGA_PORT_DMA_MAP ioctl. It is not network reachable. In typical deployments, access depends on permissions for the FPGA DFL AFU device node. If only full host root can access the device, practical exposure is reduced. If the device is delegated to users, containers, service accounts, or accelerator workloads, PR is closer to local low privilege rather than full administrator access.

Namespaces do not automatically make this reachable, but device-node delegation into containers or accelerator runtimes can lower the practical privilege requirement. The path is not default-exposed on ordinary systems because it requires FPGA DFL hardware and the driver stack.

Call-site confidence: medium. The patch shows the ioctl validation point and the commit message describes the downstream pin_user_pages_fast() truncation, but the full afu_dma_map_region() and unmap/map call chain is not included.

## 4. Severity interpretation

This is more than an ordinary validation cleanup because the unchecked length reaches a DMA page-pinning path and can create a mismatch between requested mapping length and pinned page count. Realistic impact is likely local driver/device failure or DoS unless the attacker has usable device access and favorable DMA behavior.

Theoretical worst-case impact includes memory exposure or corruption through inconsistent DMA mapping state, but the patch does not demonstrate an arbitrary write, controlled reclaim, or reliable LPE primitive. Therefore this is best treated as Actionable Moderate at minimum, with manual review for possible Important classification in products where FPGA AFU device access is delegated to non-root workloads.

## 5. One-sentence report phrase

A local DMA mapping length validation flaw in dfl-afu can truncate the page count passed to pin_user_pages_fast(), potentially creating inconsistent page pinning and DMA mapping state with DoS and possible confidentiality or integrity impact.

## 6. Manual review recommendation

MANUAL CHECK REQUIRED

Manual review is required because the bug is in a DMA mapping and page-pinning path, and the difference between constrained DoS and possible memory corruption depends on the surrounding afu_dma_map_region() behavior, IOMMU setup, device permissions, and whether non-root users can access the AFU device.

======================================================================
UPSTREAM PATCH SUMMARY
======================================================================

Patch: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region()
Commit: 59070040fd12e0b78d7b4d341d9f9a183237c5ff
Upstream URL: https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=59070040fd12e0b78d7b4d341d9f9a183237c5ff

Commit description:

afu_ioctl_dma_map() accepts a 64-bit length from userspace via
DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value
is passed to afu_dma_pin_pages() where npages is derived as
length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes
int nr_pages, causing implicit truncation if length is very large.

Validate map.length at the ioctl entry point before calling
afu_dma_map_region(), rejecting values whose page count exceeds
INT_MAX.

Fixes: fa8dda1 ("fpga: dfl: afu: add DFL_FPGA_PORT_DMA_MAP/UNMAP ioctls support")
Cc: stable@vger.kernel.org
Signed-off-by: Sebastian Alba Vives <sebasjosue84@gmail.com>
Reviewed-by: Xu Yilun <yilun.xu@intel.com>
Link: https://lore.kernel.org/r/20260518190742.61426-3-sebasjosue84@gmail.com
Signed-off-by: Xu Yilun <yilun.xu@linux.intel.com>
Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>

Changed files:
  drivers/fpga/dfl-afu-main.c

Diff excerpt:

Not included in this email. See the upstream URL for the full patch.

Full patch:
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/commit/?id=59070040fd12e0b78d7b4d341d9f9a183237c5ff

======================================================================
DETAILED REPORT METHODOLOGY
======================================================================

The original Linux kernel CVE announcement for CVE-2026-64280 can be found here:
https://lore.kernel.org/linux-cve-announce/?q=CVE-2026-64280

The original CVE announcement normally does not include a security-level
estimate. In particular, it may not contain a CVSS assessment, an impact
level, or enough information to determine whether the reported bug is a
practically relevant security issue. One purpose of this parallel CVE list
is to provide that missing technical and prioritization information.

The original goal of the AL-KERNEL project was to prioritize Linux kernel
CVE analysis automatically before manual review. The system can also help
identify non-security issues that may be suitable for automatic closure.

This report was generated by AL-KERNEL, an AI-assisted Linux kernel
vulnerability analysis system developed by Alexander Larkin.

The first analysis stage combines an autonomous classifier with additional
LLM-based analysis. The autonomous classifier runs locally on a CPU and is
based on a backpropagation neural network. Together, these mechanisms
produce a technical vulnerability description, identify likely weakness
types, estimate CVSS severity, and provide input for ActionableScore.

Two CVSS estimates are retained because incomplete kernel vulnerability
information often permits more than one defensible interpretation:

  Conservative CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:H
  The Best / paranoid CVSS vector: AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
  The Best / paranoid CVSS score: 7.8

The conservative vector represents a lower-impact interpretation.
The Best/paranoid vector intentionally represents a plausible upper-bound
interpretation and should not automatically be treated as demonstrated
real-world impact.

CVSS may also need to be adjusted for a particular Linux deployment,
because actual reachability, privileges, enabled kernel configuration,
hardware, namespaces, exposed device nodes, and other environmental
conditions can differ significantly between systems.

A separate ActionableScore mechanism evaluates practical remediation
urgency. Its analysis may include reachability, attack prerequisites,
subsystem exposure, memory-corruption characteristics, denial-of-service
reliability, and possible confidentiality, integrity, or
privilege-escalation impact.

  Conservative ActionableScore: 5
  Paranoid ActionableScore: 6

The final base severity is taken directly from the second tab-separated
field of the AL-KERNEL classification result. ActionableScore does not
replace or independently override that final AL-KERNEL decision, and
if ActionableScore adjusted impact level of ALKERNEL, then you would see
self-readable flags above like INCREASED_TO_HIGH_BASED_ON_ACTIONABLESCOREHIGHEREQTHAN7.

For an AL-KERNEL result of MODERATE, this report uses the following
additional presentation split:

  ActionableScore below 5   -> MODERATE REGULAR
  ActionableScore 5 or more -> MODERATE 7.0

The distinction between MODERATE REGULAR and MODERATE 7.0 makes it
possible to identify Moderate issues that should receive manual analysis
and fixes before lower-priority MODERATE REGULAR issues. In many cases,
MODERATE REGULAR fixes may wait for a later rebase or routine update.

There is one override in which MODERATE REGULAR becomes MODERATE 7.0
even when the ActionableScore is below 5. When the AL-KERNEL result
contains the KPANIC flag, a MODERATE result is always presented as
MODERATE 7.0. The KPANIC flag selected with few regexps without
usage of AI at all, so it helps to detect cases when Kernel Crash happens
and similar (to filter False-Negative results from the LLM usage).

KPANIC indicates that a reliable kernel crash, kernel panic, or similarly
serious kernel availability impact was identified by the classification
workflow.

AL-KERNEL base severity for this report: MODERATE
KPANIC detected for this report: YES
Published priority for this report (same as in Subject): MODERATE 7.0

These results are intended to support engineering triage. They are
machine-generated estimates, and cases marked for manual review should
be validated by a human security engineer before final disposition.
For more info read docs linked from here: https://kernelcve.org/
(and you can submit you own patch there to generate such a report
for non-existant CVE-id yet).

Note that in many cases this AI tool selects higher severity, than
real is (means you can expect Importants instead of Moderate 7.0 or
Moderates 7.0 instead of regular Moderates). If you see such cases,
please use reply email interface to add additional manual analyses
info to this particular CVE.
And please, please, let me know when you see Lows instead of Importants
or Important instead of Low (because particular for such cases I
need to tune this AI tool to make it better for this one and next similar).
My contact email for such notifications is alexanjelausa@gmail.com (and both
send reply to CVE record itself too and see "reply" button below for howto reply).