Executive brief
A vulnerability in the Linux kernel's I/O Memory Management Unit (IOMMU) subsystem could allow a local user to crash the system. By requesting an excessively large event queue, an attacker can exhaust the system's memory reserves. This results in a denial-of-service condition, impacting the availability of the server or workstation.
Technical details
A memory exhaustion vulnerability exists in the iommufd component of the Linux kernel. The function iommufd_veventq_alloc() fails to enforce a reasonable upper bound on the 'veventq_depth' parameter provided by userspace, allowing values up to U32_MAX. A local attacker can exploit this by allocating excessively large queues, leading to the exhaustion of kernel memory reserves and a system-wide denial of service. The fix introduces a cap (VEVENTQ_MAX_DEPTH) of 1 << 19 entries. Patches are available in stable kernel releases 6.18.39 and 7.1.4.
Affected products
- Linux Linux Kernel 6.15 to 6.18.39, 7.1.4, 7.2-rc1
Timeline
- 2026-07-25: disclosed
- 2026-07-25: advisory