CVE-2026-64186: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs

From: Greg Kroah-Hartman <[email protected]>

Description
===========

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs

In iommu_mmio_write() and iommu_capability_write(), the variables
dbg_mmio_offset and dbg_cap_offset are declared as int. However, they
are populated using kstrtou32_from_user(). If a user provides a
sufficiently large value, it can become a negative integer.

Prior to this patch, the AMD IOMMU debugfs implementation was already
protected by different mechanisms.

1. #define OFS_IN_SZ 8 ensures the user string <= 8 bytes, so
   e.g. 0xffffffff isn't a valid input.

  if (cnt > OFS_IN_SZ)
     return -EINVAL;

2. Implicit type promotion in iommu_mmio_write(), dbg_mmio_offset is int
   and iommu->mmio_phys_end is u64

  if (dbg_mmio_offset > iommu->mmio_phys_end - sizeof(u64))
      return -EINVAL;

3. The show handlers would currently catch the negative number and
   refuse to perform the read.

Replace kstrtou32_from_user() with kstrtos32_from_user() to parse the
input, and check for negative values to explicitly prevent out-of-bounds
memory accesses directly in iommu_mmio_write() and
iommu_capability_write().

The Linux kernel CVE team has assigned CVE-2026-64186 to this issue.


Affected and fixed versions
===========================

	Issue introduced in 6.17 with commit 7a4ee419e8c144b747a8915856e91a034d7c8f34 and fixed in 6.18.34 with commit 488d2c76bd9f78433a70690d1054bfae3d39a407
	Issue introduced in 6.17 with commit 7a4ee419e8c144b747a8915856e91a034d7c8f34 and fixed in 7.0.11 with commit 62f9dfbf1aceae88b03c5ca08f7d36e943939dec
	Issue introduced in 6.17 with commit 7a4ee419e8c144b747a8915856e91a034d7c8f34 and fixed in 7.1 with commit 8dfd3d8d74435344ee8dc9237596959c8b2a6cbe

Please see https://www.kernel.org for a full list of currently supported
kernel versions by the kernel community.

Unaffected versions might change over time as fixes are backported to
older supported kernel versions.  The official CVE entry at
	https://cve.org/CVERecord/?id=CVE-2026-64186
will be updated if fixes are backported, please check that for the most
up to date information about this issue.


Affected files
==============

The file(s) affected by this issue are:
	drivers/iommu/amd/debugfs.c


Mitigation
==========

The Linux kernel CVE team recommends that you update to the latest
stable kernel version for this, and many other bugfixes.  Individual
changes are never tested alone, but rather are part of a larger kernel
release.  Cherry-picking individual commits is not recommended or
supported by the Linux kernel community at all.  If however, updating to
the latest release is impossible, the individual changes to resolve this
issue can be found at these commits:
	https://git.kernel.org/stable/c/488d2c76bd9f78433a70690d1054bfae3d39a407
	https://git.kernel.org/stable/c/62f9dfbf1aceae88b03c5ca08f7d36e943939dec
	https://git.kernel.org/stable/c/8dfd3d8d74435344ee8dc9237596959c8b2a6cbe