Junglewise Threat Intelligence

CVE-2026-64291: Linux Kernel memory exhaustion in iommufd

CVE-2026-64291 · Severity: info · CVSS 5.5 · Published 2026-07-25

Technologies: Linux Kernel. Vendors: Linux.

Executive brief

A vulnerability in the Linux kernel's I/O Memory Management Unit (IOMMU) subsystem could allow a local user to crash the system. By requesting an excessively large event queue, an attacker can exhaust the system's memory reserves. This results in a denial-of-service condition, impacting the availability of the server or workstation.

Technical details

A memory exhaustion vulnerability exists in the iommufd component of the Linux kernel. The function iommufd_veventq_alloc() fails to enforce a reasonable upper bound on the 'veventq_depth' parameter provided by userspace, allowing values up to U32_MAX. A local attacker can exploit this by allocating excessively large queues, leading to the exhaustion of kernel memory reserves and a system-wide denial of service. The fix introduces a cap (VEVENTQ_MAX_DEPTH) of 1 << 19 entries. Patches are available in stable kernel releases 6.18.39 and 7.1.4.

Affected products

  • Linux Linux Kernel 6.15 to 6.18.39, 7.1.4, 7.2-rc1

Timeline

  • 2026-07-25: disclosed
  • 2026-07-25: advisory

References

Related threats