CVE-2026-64151 Overview
CVE-2026-64151 affects the Linux kernel's IOMMU page table (iommupt) subsystem. The driver could drop PAGE_SIZE from the pgsize_bitmap without triggering a defensive check. While technically allowed, this condition violates the design assumptions of the IOMMU domain and DMA API integration. The maintainers resolved the issue by lifting the PT_WARN_ON into the conditional branch and skipping the fast path when PAGE_SIZE is absent from pgsize_bitmap.
Critical Impact
A local, low-privileged attacker can exploit the flaw to compromise confidentiality and integrity of kernel memory managed by the IOMMU subsystem, with scope change extending impact beyond the vulnerable component.
Affected Products
- Linux kernel with the iommupt (IOMMU page table) subsystem
- Kernel builds using the DMA API against affected IOMMU domains
- Downstream distributions shipping the impacted kernel versions
Discovery Timeline
- 2026-07-19 - CVE-2026-64151 published to NVD
- 2026-07-20 - Last updated in NVD database
Technical Details for CVE-2026-64151
Vulnerability Analysis
The vulnerability resides in the iommupt driver logic that handles the pgsize_bitmap field of an iommu_domain. The pgsize_bitmap advertises the page sizes an IOMMU driver supports for mapping operations. The kernel expects PAGE_SIZE to be present in this bitmap because the DMA API and the higher-level IOMMU code depend on that granularity. The affected driver did not enforce this invariant, so a domain lacking PAGE_SIZE could reach fast-path mapping code paths that assume its presence.
When the fast path executes with an unexpected pgsize_bitmap, page table walks and mapping decisions can operate on incorrect size assumptions. This creates a kernel-level integrity and confidentiality risk, with scope extending to memory owned by other subsystems that rely on the IOMMU translations.
Root Cause
The root cause is a missing invariant check in the iommupt driver. PAGE_SIZE was not validated as part of pgsize_bitmap before the fast-path code executed. The upstream fix relocates PT_WARN_ON into the if branch and skips the fast path when the bitmap is malformed.
Attack Vector
Exploitation requires local access with low privileges and no user interaction. An attacker able to influence IOMMU domain configuration or trigger DMA operations against a misconfigured domain can reach the vulnerable code path. Successful exploitation impacts confidentiality and integrity through the IOMMU's scope-changing access to memory.
No public proof-of-concept or in-the-wild exploitation has been reported. See the Kernel Git Commit Log and the follow-up commit for the code-level fix.
Detection Methods for CVE-2026-64151
Indicators of Compromise
- Kernel log entries emitted by PT_WARN_ON referencing the iommupt driver and pgsize_bitmap
- Unexpected DMA mapping failures or IOMMU fault messages on affected hosts
- Kernel oops or warning traces originating in IOMMU page table fast-path routines
Detection Strategies
- Inventory Linux kernel versions across the fleet and compare against the patched commit hashes 00850f41da24 and 8ef3f77c4400
- Monitor dmesg and journalctl -k output for IOMMU warnings and PT_WARN_ON messages
- Correlate local privilege activity with kernel subsystem warnings using centralized log collection
Monitoring Recommendations
- Forward kernel logs to a central SIEM and alert on IOMMU-related warning patterns
- Track processes performing DMA-adjacent operations, including drivers loading against IOMMU domains
- Baseline normal IOMMU behavior per host class to surface anomalous fault rates
How to Mitigate CVE-2026-64151
Immediate Actions Required
- Apply the upstream kernel patches referenced by commits 00850f41da24423587abd6124a790dd4f12bcef3 and 8ef3f77c440005c7f04229a75976bfc078364247
- Update to the vendor kernel package that incorporates these fixes as soon as your distribution publishes it
- Restrict local access on systems where the patch has not yet been deployed
Patch Information
The fix lifts PT_WARN_ON into the conditional branch and skips the IOMMU page table fast path when PAGE_SIZE is missing from pgsize_bitmap. Rebuild affected kernels from stable trees containing the linked commits, or install the corresponding distribution kernel update. Reboot is required for the new kernel to take effect.
Workarounds
- Limit shell access and local logon rights to trusted administrators until the patched kernel is deployed
- Audit and constrain kernel modules that create or modify IOMMU domains on production hosts
- Where feasible, disable optional IOMMU-backed features on systems that do not require DMA remapping
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
