Look up another CVE · open CVE-2026-64232 in the interactive tracker
CVE-2026-64232
block: recompute nr_integrity_segments in blk_insert_cloned_request
Published 2026-07-24 (3 months ago) by the Linux kernel CNA. Subsystem block. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-64232 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | fixed | 6.12.94-1 | Update the kernel and reboot. Fixed in 6.12.94-1. A running kernel keeps the old code until the machine restarts. |
| Debian 14forky | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.0.12-1 | Update the kernel and reboot. Fixed in 7.0.12-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
blk_insert_cloned_request() already recomputes nr_phys_segments against the bottom queue, because "the queue settings related to segment counting may differ from the original queue." The exact same reasoning applies to integrity segments: a stacked driver's underlying queue can have tighter virt_boundary_mask, seg_boundary_mask, or max_segment_size than the top queue, in which case blk_rq_count_integrity_sg() against the bottom queue produces a different count than the cached rq->nr_integrity_segments inherited from the source request by blk_rq_prep_clone(). When the cached count is lower than the bottom queue's actual count, blk_rq_map_integrity_sg() trips BUG_ON(segments > rq->nr_integrity_segments); on dispatch. The same families of stacked setups that motivated the existing nr_phys_segments recompute -- dm-multipath fanning out to nvme-rdma in particular -- can produce this. Mirror the nr_phys_segments handling: when the request carries integrity, recompute nr_integrity_segments against the bottom queue and reject the request if it exceeds the bottom queue's max_integrity_segments. blk_rq_count_integrity_sg() and queue_max_integrity_segments() are both already available via <linux/blk-integrity.h>, which blk-mq.c includes. This closes a latent gap in the stacking contract and brings the integrity-segment accounting in line with the existing phys-segment accounting.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
block/blk-mq.c
- What this is
- BLOCK LAYERMAINTAINERS section matched on block/ · linux-block@vger.kernel.org · Maintained
Show whether Debian builds this, per release
Debian builds this code. Every release below compiles the affected file into the kernels it ships.
- bookworm, trixie, forky, sidy
- y
- built into the kernel image on every flavour - only a patch removes it
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS Debian linux-config packages
Signals
- Published
- 2026-07-24 (3 months ago)source
- CVSS
- 9.8 critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- network (AV:N)source
- EPSS
- 0.46%, higher than 38.2% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- block
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.12 | 6.12.92 | 53a01bcc0242 |
| 6.12 | 6.18.34 | 0943f81e1b31 |
| 6.12 | 7.0.11 | 42929c98d044 |
| 6.12 | 7.1 | 2c6e6a18a37b |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:NAttack vector, network
- A PI-enabled iSER or NVMe/RDMA target can expose the affected request-based dm-multipath device, allowing remote storage commands to reach the vulnerable clone-dispatch path.
- AC:LAttack complexity, low
- Once the affected storage topology is configured, the attacker controls the metadata-bearing I/O requests and can trigger the segment-count mismatch repeatedly without winning an uncontrollable race.
- PR:NPrivileges required, none
- Targets configured with dynamic ACLs and authentication disabled, or NVMe allow_any_host, permit unauthenticated remote initiators to issue the required I/O.
- UI:NUser interaction, none
- No victim action is required after the network storage target and affected backend are operational.
- S:UScope, unchanged
- The corruption occurs within the host kernel processing the target's block I/O and does not inherently cross a separate security authority such as a guest-host boundary.
- C:HConfidentiality impact, high
- The undersized integrity scatterlist is populated beyond its declared bounds before the BUG_ON executes, permitting adjacent kernel-memory corruption that could be leveraged for arbitrary kernel access and disclosure.
- I:HIntegrity impact, high
- The out-of-bounds scatterlist writes corrupt kernel memory and may permit control-flow hijacking or arbitrary modification if the attacker shapes the surrounding allocation state.
- A:HAvailability impact, high
- The post-write BUG_ON reliably causes a kernel oops or panic, and malformed requests can be submitted repeatedly to disrupt the storage target.