---
id: CVE-2026-64053
title: 'block: don''t overwrite bip_vcnt in bio_integrity_copy_user()'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  block: don't overwrite bip_vcnt in bio_integrity_copy_user()

  bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce
  segment. Overwriting it with nr_vecs br…
severity: high
cvss: 7.8
cvssVector: 'CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H'
cvssSource: cna
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= 3991657ae7074c3c497bf095093178bed37ea1b4 <
    d18160c9525c63c203656fefd847e94b538cd4a4
  - >-
    Linux >= 3991657ae7074c3c497bf095093178bed37ea1b4 <
    0d48654af4d1390c888389206cc13b51b82c30e6
  - >-
    Linux >= 3991657ae7074c3c497bf095093178bed37ea1b4 <
    066be1439593a381b1a29663becfcfe0c92363e7
  - >-
    Linux >= 3991657ae7074c3c497bf095093178bed37ea1b4 <
    637ad3a56a3b889527d1dacea6fea2a8bd648140
  - Linux 6.11
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: total
  timestamp: '2026-10-16T15:36:00.465098Z'
published: '2026-07-19'
updated: '2026-10-16'
sourceUpdated: '2026-10-16T15:42:21.153Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64053'
references:
  - url: 'https://git.kernel.org/stable/c/d18160c9525c63c203656fefd847e94b538cd4a4'
  - url: 'https://git.kernel.org/stable/c/0d48654af4d1390c888389206cc13b51b82c30e6'
  - url: 'https://git.kernel.org/stable/c/066be1439593a381b1a29663becfcfe0c92363e7'
  - url: 'https://git.kernel.org/stable/c/637ad3a56a3b889527d1dacea6fea2a8bd648140'
tags:
  - cve.org
epss: 0.00129
epssPercentile: 0.02229
ingestedAt: '2026-10-16T17:24:46.803Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

block: don't overwrite bip_vcnt in bio_integrity_copy_user()

bio_integrity_add_page() already sets bip_vcnt to 1 for the bounce
segment. Overwriting it with nr_vecs breaks bip_vcnt <= bip_max_vcnt
on WRITE (bip_max_vcnt is 1), so the gap-merge checks in block/blk.h
read past the bip_vec[] flex array. On READ the read is in bounds
but lands on a saved user bvec instead of the bounce.

The line was added for split propagation, but bio_integrity_clone()
doesn't copy bip_vcnt and BIP_CLONE_FLAGS excludes BIP_COPY_USER.

## Affected

- `Linux >= 3991657ae7074c3c497bf095093178bed37ea1b4 < d18160c9525c63c203656fefd847e94b538cd4a4`
- `Linux >= 3991657ae7074c3c497bf095093178bed37ea1b4 < 0d48654af4d1390c888389206cc13b51b82c30e6`
- `Linux >= 3991657ae7074c3c497bf095093178bed37ea1b4 < 066be1439593a381b1a29663becfcfe0c92363e7`
- `Linux >= 3991657ae7074c3c497bf095093178bed37ea1b4 < 637ad3a56a3b889527d1dacea6fea2a8bd648140`
- `Linux 6.11`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.