CVE-2025-68760

iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show

State
Published
Severity
Not scored
Published
Jan 5, 2026
Updated
May 11, 2026
Reserved
Dec 24, 2025

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Fix potential out-of-bounds read in iommu_mmio_show

In iommu_mmio_write(), it validates the user-provided offset with the check: `iommu->dbg_mmio_offset > iommu->mmio_phys_end - 4`. This assumes a 4-byte access. However, the corresponding show handler, iommu_mmio_show(), uses readq() to perform an 8-byte (64-bit) read.

If a user provides an offset equal to `mmio_phys_end - 4`, the check passes, and will lead to a 4-byte out-of-bounds read.

Fix this by adjusting the boundary check to use sizeof(u64), which corresponds to the size of the readq() operation.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • 7a4ee419e8c144b747a8915856e91a034d7c8f34 to before b959df804c33913dbfdb90750f2d693502b3d126Affected
  • 7a4ee419e8c144b747a8915856e91a034d7c8f34 to before 0ec4aaf5f3f559716a6559f3d6d9616e9470bed6Affected
  • 7a4ee419e8c144b747a8915856e91a034d7c8f34 to before a0c7005333f9a968abb058b1d77bbcd7fb7fd1e7Affected
LinuxLinux
  • 6.17Affected
  • before 6.17Not affected
  • 6.17.13 through 6.17.*Not affected
  • 6.18.2 through 6.18.*Not affected
  • 6.19 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.