CyberRota Analysis
AI-GeneratedThe vulnerability affects the Linux kernel's handling of DMA mapping in the DFL FPGA driver, where user-supplied length values are not properly bounded, potentially leading to integer overflow and memory corruption. This flaw could allow an attacker to exploit the system by providing excessively large values, resulting in denial of service or arbitrary code execution. Organizations using affected Linux distributions, particularly those deploying FPGA hardware, should prioritize patching to mitigate potential exploitation risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: fpga: dfl-afu: validate DMA mapping length in afu_dma_map_region() afu_ioctl_dma_map() accepts a 64-bit length from userspace via DFL_FPGA_PORT_DMA_MAP ioctl without an upper bound check. The value is passed to afu_dma_pin_pages() where npages is derived as length >> PAGE_SHIFT and passed to pin_user_pages_fast() which takes int nr_pages, causing implicit truncation if length is very large. Validate map.length at the ioctl entry point before calling afu_dma_map_region(), rejecting values whose page count exceeds INT_MAX.
Related CVEs
Other vulnerabilities affecting the same vendor(s)