Skip to content
CVE PROGRAM SOURCE RECORDUnscored

CVE-2026-64291

iommufd: Set veventq_depth upper bound

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
Linux

Description

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with an upper bound at U32_MAX. This leaves a vulnerability where userspace can allocate excessively large queues to exhaust kernel memory reserves. Cap the veventq_depth (maximum number of entries) to 1 << 19, matching the maximum number of entries in the SMMUv3 EVTQ (the largest use case today).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Linux Linux

Default version status: unaffected

  • e36ba5ab808ef6237c3148d469c8238674230e2b to < f565297edf316016be4a1a9e2eb9f39359313f43affected
  • e36ba5ab808ef6237c3148d469c8238674230e2b to < e7b5e55652746b1221b9c10ff80eae8a154101baaffected
  • e36ba5ab808ef6237c3148d469c8238674230e2b to < 6ebf2eb46fbd5b40393ff8fbb847ba96925beaffaffected

Linux Linux

Default version status: affected

  • 6.15affected
  • 0 to < 6.15unaffected
  • 6.18.39 to ≤ 6.18.*unaffected
  • 7.1.4 to ≤ 7.1.*unaffected
  • 7.2 to ≤ *unaffected

References