GHSA-C496-VR74-8PGF
Vulnerability from github – Published: 2026-07-24 18:31 – Updated: 2026-07-24 18:31In the Linux kernel, the following vulnerability has been resolved:
NTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR
When BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, the module teardown path ends up calling pci_iounmap() on the same iomem with some offset, which is unnecessary and triggers a kernel warning like the following:
Trying to vunmap() nonexistent vm area (0000000069a5ffe8) WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937 [...] Call trace: vunmap+0x58/0x68 (P) iounmap+0x34/0x48 pci_iounmap+0x2c/0x40 ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf] pci_device_remove+0x48/0xf8 device_remove+0x50/0x88 device_release_driver_internal+0x1c8/0x228 driver_detach+0x50/0xb0 bus_remove_driver+0x74/0x100 driver_unregister+0x34/0x68 pci_unregister_driver+0x34/0xa0 ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf] [...]
Fix it by unmapping only when PEER_SPAD and CONFIG use difference bars.
{
"affected": [],
"aliases": [
"CVE-2026-64254"
],
"database_specific": {
"cwe_ids": [],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2026-07-24T16:16:55Z",
"severity": null
},
"details": "In the Linux kernel, the following vulnerability has been resolved:\n\nNTB: epf: Avoid pci_iounmap() with offset when PEER_SPAD and CONFIG share BAR\n\nWhen BAR_PEER_SPAD and BAR_CONFIG share one PCI BAR, the module teardown\npath ends up calling pci_iounmap() on the same iomem with some offset,\nwhich is unnecessary and triggers a kernel warning like the following:\n\n Trying to vunmap() nonexistent vm area (0000000069a5ffe8)\n WARNING: mm/vmalloc.c:3470 at vunmap+0x58/0x68, CPU#5: modprobe/2937\n [...]\n Call trace:\n vunmap+0x58/0x68 (P)\n iounmap+0x34/0x48\n pci_iounmap+0x2c/0x40\n ntb_epf_pci_remove+0x44/0x80 [ntb_hw_epf]\n pci_device_remove+0x48/0xf8\n device_remove+0x50/0x88\n device_release_driver_internal+0x1c8/0x228\n driver_detach+0x50/0xb0\n bus_remove_driver+0x74/0x100\n driver_unregister+0x34/0x68\n pci_unregister_driver+0x34/0xa0\n ntb_epf_pci_driver_exit+0x14/0xfe0 [ntb_hw_epf]\n [...]\n\nFix it by unmapping only when PEER_SPAD and CONFIG use difference bars.",
"id": "GHSA-c496-vr74-8pgf",
"modified": "2026-07-24T18:31:29Z",
"published": "2026-07-24T18:31:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-64254"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/06f6dd2ff2bd07eaf7178a807407ff27e85122b4"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/81371dbd23601f67f01372817fdbab42c5601e43"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/9764a786ba98db58f0725913c369e721253aba33"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/a4be4a1308f02bff79a30eea2d04ead5b63685f2"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/d876153680e3d721d385e554def919bce3d18c74"
},
{
"type": "WEB",
"url": "https://git.kernel.org/stable/c/eb47b9bffd07a47b84910847cb5ea066ce184055"
}
],
"schema_version": "1.4.0",
"severity": []
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.