CVE-2026-64291: iommufd: Set veventq_depth upper bound
Greg Kroah-Hartman <[email protected]> Sat, 25 Jul 2026 10:48:28 +0200
| Newsgroups | org.kernel.vger.linux-cve-announce |
|---|---|
| Message-ID | <2026072504-CVE-2026-64291-7b0c@gregkh> |
From: Greg Kroah-Hartman <[email protected]> Description =========== In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with an upper bound at U32_MAX. This leaves a vulnerability where userspace can allocate excessively large queues to exhaust kernel memory reserves. Cap the veventq_depth (maximum number of entries) to 1 << 19, matching the maximum number of entries in the SMMUv3 EVTQ (the largest use case today). The Linux kernel CVE team has assigned CVE-2026-64291 to this issue. Affected and fixed versions =========================== Issue introduced in 6.15 with commit e36ba5ab808ef6237c3148d469c8238674230e2b and fixed in 6.18.39 with commit f565297edf316016be4a1a9e2eb9f39359313f43 Issue introduced in 6.15 with commit e36ba5ab808ef6237c3148d469c8238674230e2b and fixed in 7.1.4 with commit e7b5e55652746b1221b9c10ff80eae8a154101ba Issue introduced in 6.15 with commit e36ba5ab808ef6237c3148d469c8238674230e2b and fixed in 7.2-rc1 with commit 6ebf2eb46fbd5b40393ff8fbb847ba96925beaff Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2026-64291 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: drivers/iommu/iommufd/eventq.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/f565297edf316016be4a1a9e2eb9f39359313f43 https://git.kernel.org/stable/c/e7b5e55652746b1221b9c10ff80eae8a154101ba https://git.kernel.org/stable/c/6ebf2eb46fbd5b40393ff8fbb847ba96925beaff