Executive brief
A vulnerability was identified in the Linux kernel's FPGA (Field Programmable Gate Array) subsystem. The software fails to properly check the size of memory requests when mapping hardware resources, which could allow a local user to cause system instability or potentially gain unauthorized access to memory. This affects systems using Device Feature List (DFL) based FPGA accelerators.
Technical details
An integer truncation vulnerability exists in the Linux kernel's FPGA DFL-AFU driver within the afu_ioctl_dma_map() function. The driver accepts a 64-bit length value from userspace via the DFL_FPGA_PORT_DMA_MAP ioctl without performing an upper-bound check. This value is subsequently passed to afu_dma_pin_pages(), where it is shifted to calculate a page count (npages) and then passed to pin_user_pages_fast(). Because pin_user_pages_fast() expects a signed integer for the number of pages, providing an extremely large 64-bit length causes an implicit truncation. This can lead to incorrect memory pinning behavior. The issue has been resolved by validating that the page count derived from the requested length does not exceed INT_MAX.
Affected products
- Linux Linux Kernel 4.19 to 7.1.4
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory