# CVE-2026-64232: CVE-2026-64232 Status: published. Published: 2026-07-24. Updated: 2026-11-08. In the Linux kernel, the following vulnerability has been resolved: block: recompute nr_integrity_segments in blk_insert_cloned_request blk_insert_cloned_request() already recomputes nr_phys_segments against the bottom queue, because "the queue settings related to segment counting may differ from the original queue." The exact same reasoning applies to integrity segments: a stacked driver's underlying queue can have tighter virt_boundary_mask, seg_boundary_mask, or max_segment_size than the top queue, in which case blk_rq_count_integrity_sg() against the bottom queue produces a different count than the cached rq->nr_integrity_segments inherited from the source request by blk_rq_prep_clone(). When the cached count is lower than the bottom queue's actual count, blk_rq_map_integrity_sg() trips BUG_ON(segments > rq->nr_integrity_segments); on dispatch. The same families of stacked setups that motivated the existing nr_phys_segments recompute -- dm-multipath fanning out to nvme-rdma in particular -- can produce this. Mirror the nr_phys_segments handling: when the request carries integrity, recompute nr_integrity_segments against the bottom queue and reject the request if it exceeds the bottom queue's max_integrity_segments. blk_rq_count_integrity_sg() and queue_max_integrity_segments() are both already available via , which blk-mq.c includes. This closes a latent gap in the stacking contract and brings the integrity-segment accounting in line with the existing phys-segment accounting. ## Remediation - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/0943f81e1b3176f27dbaf6db268fc69d8a94f0ba - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/2c6e6a18a37b905cb584eb0dda3ae482162a81ca - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/42929c98d044f126508baf54a65b0f87f932fa75 - fix: The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches. (source: 416baaa9-dc9f-4396-8d5f-8c081fb06d67) — https://git.kernel.org/stable/c/53a01bcc0242590eda4c452a5bd996f62457113b ## Affected products and versions - linux / linux_kernel: ≥ 6.12; < 6.12.92 (affected, custom). Source: NVD - linux / linux_kernel: ≥ 6.13; < 6.18.34 (affected, custom). Source: NVD - linux / linux_kernel: ≥ 6.19; < 7.0.11 (affected, custom). Source: NVD - linux / linux_kernel: 7.1 (affected, custom). Source: NVD ## NVD configuration conditions Affected CPE matches depend on the following AND/OR and negation conditions: ```json [ { "negate": false, "nodes": [ { "cpeMatch": [ { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.12.92", "versionStartIncluding": "6.12", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "6.18.34", "versionStartIncluding": "6.13", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionEndExcluding": "7.0.11", "versionStartIncluding": "6.19", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc1:*:*:*:*:*:*", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc2:*:*:*:*:*:*", "vulnerable": true }, { "criteria": "cpe:2.3:o:linux:linux_kernel:7.1:rc3:*:*:*:*:*:*", "vulnerable": true } ], "negate": false, "operator": "OR" } ], "operator": "OR" } ] ``` ## Severity and prioritization - CVSS 3.1: 9.8 (critical); CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H; source: NVD: 416baaa9-dc9f-4396-8d5f-8c081fb06d67 - CISA KEV: No listing in collected sources - EPSS: Not available - SSVC: exploitation none; automatable yes; technical impact total; source NVD SSVC: 134c704f-9b21-4f2e-91b3-4a467353bcc0 - Weaknesses: CWE-667 ## Exploit evidence No exploit evidence in collected sources. This is not proof of no exploitation. ## References - https://git.kernel.org/stable/c/0943f81e1b3176f27dbaf6db268fc69d8a94f0ba (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch) - https://git.kernel.org/stable/c/2c6e6a18a37b905cb584eb0dda3ae482162a81ca (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch) - https://git.kernel.org/stable/c/42929c98d044f126508baf54a65b0f87f932fa75 (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch) - https://git.kernel.org/stable/c/53a01bcc0242590eda4c452a5bd996f62457113b (416baaa9-dc9f-4396-8d5f-8c081fb06d67; Patch) ## Provenance - NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-64232; retrieved 2026-11-09; source updated 2026-11-08 Revision: a93b8b0c888d9f101e51e20d74ef05cd8d7f24d526023f162708a012ef904374 Canonical: https://y2.dev/cve/CVE-2026-64232 ## Agent and API access Public CVE pages, Markdown, and JSON are free to read without an account or API key. - Public catalog: https://y2.dev/cve/index.json. Follow nextCursor with the same search, filters, sort, and limit (1–100). A null cursor marks the end. - WebMCP: search_cve_disclosures, get_cve_disclosure, get_cve_page_markdown, get_y2_cve_access. Available in compatible browsers. - Cyber API: https://api.y2.dev/api/v2/cyber/cves and https://api.y2.dev/api/v2/cyber/cves/{cveId}. - Y2 Pro or Elite: create a workspace API key with the intel:cyber scope and send Authorization: Bearer . Setup: https://y2.dev/docs/api/create-key. - x402: Pay per request without an account or API key. Omit Authorization, read the HTTP 402 PAYMENT-REQUIRED challenge, validate its current requirements, and retry with PAYMENT-SIGNATURE through an authorized payment client. These browser tools never make payments. Guide: https://y2.dev/docs/api/x402. - OpenAPI: https://y2.dev/api/openapi.yaml. Agent access metadata: https://y2.dev/cve/agent.json. Collected public records only. Check source status for coverage and freshness.