Executive brief
A vulnerability was identified in the Linux kernel's IOMMU file descriptor (iommufd) component, which manages memory access for hardware devices. On 32-bit systems, a programming error in how the system checks memory boundaries could allow a local attacker to cause the system to write data past the end of a designated buffer. This could potentially lead to system instability or unauthorized access to sensitive kernel memory.
Technical details
A vulnerability in iommufd_veventq_fops_read() in the Linux kernel stems from using sizeof(hdr) instead of sizeof(*hdr) during a bounds check. Since 'hdr' is a pointer to struct iommufd_vevent_header, sizeof(hdr) returns the pointer size (4 bytes on 32-bit systems) rather than the structure size (8 bytes). This discrepancy allows a vEVENT with specific data_len values to bypass the bounds check, resulting in a copy_to_user() operation that writes 8 bytes of header plus payload into a user-supplied buffer that may only have space for 4 bytes plus payload. This leads to a kernel-to-user buffer overflow. The issue primarily affects 32-bit architectures and has been patched in various stable branches including 6.18.39 and 7.1.4.
Affected products
- Linux Linux Kernel 6.15 to 6.18.39, 7.1.4
Timeline
- 2026-04-30: disclosed: Vulnerability reported by Kai Aizen
- 2026-05-08: patched: Initial fix committed to mainline kernel
- 2026-07-25: advisory: CVE-2026-64293 published