Riskcovery

CVE-2026-64291

iommufd: Set veventq_depth upper bound

State
Published
Severity
Not scored
Published
Jul 25, 2026
Updated
Aug 17, 2026
Reserved
Jul 19, 2026

Read the record on cve.org

Description

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Set veventq_depth upper bound

iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with an upper bound at U32_MAX.

This leaves a vulnerability where userspace can allocate excessively large queues to exhaust kernel memory reserves.

Cap the veventq_depth (maximum number of entries) to 1 << 19, matching the maximum number of entries in the SMMUv3 EVTQ (the largest use case today).

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
LinuxLinux
  • e36ba5ab808ef6237c3148d469c8238674230e2b to before f565297edf316016be4a1a9e2eb9f39359313f43Affected
  • e36ba5ab808ef6237c3148d469c8238674230e2b to before e7b5e55652746b1221b9c10ff80eae8a154101baAffected
  • e36ba5ab808ef6237c3148d469c8238674230e2b to before 6ebf2eb46fbd5b40393ff8fbb847ba96925beaffAffected
LinuxLinux
  • 6.15Affected
  • before 6.15Not affected
  • 6.18.39 through 6.18.*Not affected
  • 7.1.4 through 7.1.*Not affected
  • 7.2 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.