CVE-2026-64291 Details
Description
In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with an upper bound at U32_MAX. This leaves a vulnerability where userspace can allocate excessively large queues to exhaust kernel memory reserves. Cap the veventq_depth (maximum number of entries) to 1 << 19, matching the maximum number of entries in the SMMUv3 EVTQ (the largest use case today).
A vulnerability in the Linux kernel's IOMMUFD event queue allocation function allows userspace to allocate excessively large queues, potentially exhausting kernel memory reserves. This issue arises because the function accepts any non-zero event queue depth from userspace, with an upper limit of U32_MAX. To address this vulnerability, the event queue depth has been capped at 1 << 19, aligning with the maximum number of entries in the SMMUv3 event queue, which is the largest use case currently.
Users can upgrade to the latest version of the Linux kernel where this vulnerability has been addressed. Instructions for downloading the patched version are available on the Linux Kernel Archive.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
No SSVC data is available for this CVE.
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://git.kernel.org/stable/c/6ebf2eb46fbd5b40393ff8fbb847ba96925beaff | kernel.org | Patch |
| https://git.kernel.org/stable/c/e7b5e55652746b1221b9c10ff80eae8a154101ba | kernel.org | Patch |
| https://git.kernel.org/stable/c/f565297edf316016be4a1a9e2eb9f39359313f43 | kernel.org | Patch |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| NVD-CWE-noinfo | Insufficient Information to Classify Weakness | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| linux linux kernel | >= 6.15, < 6.18.39 >= 6.19, < 7.1.4 |
CPE
Remediation
| |
Change History
3 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 17, 2026 | CVE Modified | kernel.org |
| Aug 12, 2026 | Initial Analysis | [email protected] |
| Jul 25, 2026 | New CVE Received | kernel.org |