CVE-2026-64124: Software Security Vulnerability Vulnerability

HIGH
Advisory Identifier: GHSA-36q3-p7rr-w76h
Share
CVSS 8.8
Published
Advisory Summary

CVE-2026-64124 is a HIGH (CVSS 8.8) security vulnerability vulnerability (General Security Weakness) affecting Software libraries in the Maven ecosystem. Remediation is available in the latest vendor maintenance releases.

CVE-2026-64124 at a Glance

CVE Identifier CVE-2026-64124
GHSA Identifier GHSA-36q3-p7rr-w76h
Severity HIGH
CVSS v3.1 Base Score 8.8
CWE Classification General Security Weakness
Affected Product Software
Package Ecosystem Maven
Published Date
Last Updated

Security Impact

CVSS: 8.8

The security impact metrics below are parsed directly from the CVSS v3.1 vector string (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H).

Attack Vector Local (AV:L)
Attack Complexity Low (AC:L)
Privileges Required Low (PR:L)
User Interaction None (UI:N)
Scope Changed (S:C)
Confidentiality High (C:H)
Integrity High (I:H)
Availability High (A:H)

How to Fix CVE-2026-64124

To remediate this vulnerability, upgrade all affected Software dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.

Verify Direct and Transitive Dependencies

Run the following command in your project directory to verify that all resolved dependencies use the patched release: 

mvn dependency:tree

How to Check if You Are Affected

To determine whether your Java application is affected by CVE-2026-64124, inspect your build dependencies using the Maven Dependency Plugin:

mvn dependency:tree

Analyze the terminal output to locate any version of Software in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than the patched release), your application is affected.

Note: The mvn dependency:tree command inspects the resolved dependency graph declared in your project's POM files; it does not perform automated security scanning or inspect runtime dynamic classpaths. Always verify runtime container classpaths and shaded JARs.

Technical Details

Vulnerability Mechanism & Technical Analysis

This vulnerability is classified under General Security Weakness. In Software, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.

Source Advisory Statement

In the Linux kernel, the following vulnerability has been resolved: net: devmem: reject dma-buf bind with non-page-aligned size or SG length net_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be PAGE_SIZE multiples without checking: - tx_vec is sized dmabuf->size / PAGE_SIZE, and net_devmem_get_niov_at() only bounds-checks virt_addr < dmabuf->size before indexing tx_vec[virt_addr / PAGE_SIZE]. With size = N*PAGE_SIZE + r (1 <= r < PAGE_SIZE), sendmsg() at iov_base = N*PAGE_SIZE passes the bound check and reads tx_vec[N] -- one past. - owner->area.num_niovs = len / PAGE_SIZE while gen_pool_add_owner() covers the full byte len, so a non-page-multiple non-final sg desyncs num_niovs from the gen_pool region for every later sg, on both RX and TX. dma-buf does not require page-aligned sizes, so the bind path has to enforce what its own indexing assumes. Reject both with -EINVAL. The size check is TX-only (only tx_vec is sized off dmabuf->size); the SG-length check covers both directions.

References

NVD — CVE-2026-64124 NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-64124
git.kernel.org/stable/c/134c517dfa... WEB
https://git.kernel.org/stable/c/134c517dfa63203287b2aad6558017f42435a02e
git.kernel.org/stable/c/4eb82ba543... WEB
https://git.kernel.org/stable/c/4eb82ba543421e9e38cc14e4e82058b78850df50
git.kernel.org/stable/c/d5008e4e4e... WEB
https://git.kernel.org/stable/c/d5008e4e4ee6b739256b796702a7d1aae1b5c3b4

Frequently Asked Questions

What is CVE-2026-64124?
CVE-2026-64124 is a security vulnerability in Software classified as a security vulnerability vulnerability under General Security Weakness.
Which Software versions are affected?
Affected versions include releases prior to current release patches.
What version fixes CVE-2026-64124?
Upgrading to current release patches (or the latest patched release for your respective branch) resolves the vulnerability.
What is the CVSS score of CVE-2026-64124?
CVE-2026-64124 has a CVSS v3.1 base score of 8.8 (HIGH) with vector string CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H.
What CWE is associated with CVE-2026-64124?
CVE-2026-64124 is classified under General Security Weakness.
How can I check Maven dependencies for CVE-2026-64124?
Run the dependency tree command: 'mvn dependency:tree'. This command lists direct and transitive dependencies in your build configuration so you can verify if a vulnerable version is resolved.
Machine-readable OSV JSON OSV v1.5 Schema
Normalized schema output
View Raw JSON 
{
  "schema_version" : "1.4.0",
  "id" : "GHSA-36q3-p7rr-w76h",
  "modified" : "2026-07-20T15:32:00Z",
  "published" : "2026-07-19T18:31:52Z",
  "aliases" : [ "CVE-2026-64124" ],
  "details" : "In the Linux kernel, the following vulnerability has been resolved:\n\nnet: devmem: reject dma-buf bind with non-page-aligned size or SG length\n\nnet_devmem_bind_dmabuf() trusts dmabuf->size and sg_dma_len() to be\nPAGE_SIZE multiples without checking:\n\n  - tx_vec is sized dmabuf->size / PAGE_SIZE, and\n    net_devmem_get_niov_at() only bounds-checks virt_addr < dmabuf->size\n    before indexing tx_vec[virt_addr / PAGE_SIZE]. With size =\n    N*PAGE_SIZE + r (1 <= r < PAGE_SIZE), sendmsg() at iov_base =\n    N*PAGE_SIZE passes the bound check and reads tx_vec[N] -- one past.\n\n  - owner->area.num_niovs = len / PAGE_SIZE while gen_pool_add_owner()\n    covers the full byte len, so a non-page-multiple non-final sg\n    desyncs num_niovs from the gen_pool region for every later sg, on\n    both RX and TX.\n\ndma-buf does not require page-aligned sizes, so the bind path has to\nenforce what its own indexing assumes. Reject both with -EINVAL.\n\nThe size check is TX-only (only tx_vec is sized off dmabuf->size); the\nSG-length check covers both directions.",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H"
  } ],
  "affected" : [ ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2026-64124"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/134c517dfa63203287b2aad6558017f42435a02e"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/4eb82ba543421e9e38cc14e4e82058b78850df50"
  }, {
    "type" : "WEB",
    "url" : "https://git.kernel.org/stable/c/d5008e4e4ee6b739256b796702a7d1aae1b5c3b4"
  } ],
  "database_specific" : {
    "cwe_ids" : [ ],
    "severity" : "HIGH",
    "github_reviewed" : false,
    "github_reviewed_at" : null,
    "nvd_published_at" : "2026-07-19T16:17:54Z"
  }
}