CVE-2026-64283

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

KVM: guest_memfd: Treat memslot binding offset+size as unsigned values

When binding a memslot to a guest_memfd file, treat the offset and size as

unsigned values to fix a bug where the sum of the two can result in a false

negative when checking for overflow against the size of the file. Passing

unsigned values also avoids relying on somewhat obscure checks in other

flows for safety, and tracks the offset and size as they are intended to be

tracked, as unsigned values.

On 64-bit kernels, the number of pages a memslot contains and thus the size

(and offset) of its guest_memfd binding are unsigned 64-bit values. Taking

the offset+size as an loff_t instead of a uoff_t inadvertently converts

the unsigned value to a signed value if the offset and/or size is massive.

Locally storing the offset and size as signed values is benign in and of

itself (though even that is *extremely* difficult to discern), but

operating on th

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References