CVE-2026-64152: Linux Kernel IOMMU Debug Error Handling

CVE-2026-64152 Overview

CVE-2026-64152 is a Linux kernel vulnerability in the Input-Output Memory Management Unit (IOMMU) subsystem. The flaw involves improper error handling in the map failure path when iommu_debug is enabled. When a mapping operation fails, the kernel calls iommu_unmap(), which invokes iommu_debug_unmap_begin() and iommu_debug_unmap_end(). Because the original iommu_debug_map() was never established on this error path, the debug tracking becomes unbalanced and malfunctions.

Critical Impact
Local attackers with low privileges can trigger unbalanced IOMMU debug tracking, potentially leading to kernel state corruption affecting confidentiality, integrity, and availability.

Affected Products

Linux kernel versions containing the affected IOMMU debug code paths
Systems with iommu_debug enabled in kernel configuration
Distributions that have not yet backported the upstream fix

Discovery Timeline

2026-07-19 - CVE-2026-64152 published to the National Vulnerability Database (NVD)
2026-07-20 - Last updated in NVD database

Technical Details for CVE-2026-64152

Vulnerability Analysis

The vulnerability resides in the Linux kernel IOMMU subsystem's debug instrumentation. When iommu_map_nosync() encounters a mapping error, the cleanup path calls iommu_unmap(). This function invokes the debug hooks iommu_debug_unmap_begin() and iommu_debug_unmap_end() as part of its normal operation.

The defect is that the error path never called iommu_debug_map() in the first place. The debug tracking mechanism relies on paired map and unmap events. Calling only the unmap side without a corresponding map produces unbalanced tracking state and generates misleading trace records.

The upstream fix lifts unmap error handling into iommu_map_nosync() and reorders operations so that trace_map() and iommu_debug_map() first record the partial mapping. The kernel then immediately unmaps it. This preserves proper pairing of debug events and eliminates the unbalanced tracking condition.

Root Cause

The root cause is an ordering flaw in kernel IOMMU error handling. The map failure cleanup path invoked debug unmap instrumentation without a matching debug map event. This constitutes an atomicity and state-tracking violation within the IOMMU debug subsystem.

Attack Vector

Exploitation requires local access with low privileges. A local attacker capable of triggering IOMMU map operations on a kernel built with iommu_debug enabled can drive the failing map path. The resulting unbalanced debug state affects kernel confidentiality, integrity, and availability. No user interaction is required.

Code examples are not available for this issue. Refer to the upstream commits 0735c54804c7 and 0cd028806efc for the exact source changes.

Detection Methods for CVE-2026-64152

Indicators of Compromise

Kernel log entries showing IOMMU map failures followed by unbalanced debug unmap traces
Unexpected trace_map() or iommu_debug_map() sequences without matched pairs
Kernel warnings or oops messages originating in iommu_map_nosync() or iommu_unmap() code paths

Detection Strategies

Audit running kernels for CONFIG_IOMMU_DEBUG configuration and identify systems requiring priority patching
Compare kernel package versions against distribution advisories tied to commits 0735c54804c7 and 0cd028806efc
Correlate IOMMU-related kernel traces with process activity to identify local users triggering map failures

Monitoring Recommendations

Ingest kernel ring buffer output into a centralized logging pipeline and alert on IOMMU subsystem warnings
Monitor for unprivileged processes performing high-frequency device I/O or DMA-related operations
Track kernel version drift across the fleet to ensure timely deployment of stable-tree updates

How to Mitigate CVE-2026-64152

Immediate Actions Required

Apply the upstream Linux kernel patches referenced in commits 0735c54804c7 and 0cd028806efc as soon as vendor packages are available
Inventory kernels built with iommu_debug enabled and prioritize them for remediation
Restrict local shell access on multi-tenant systems until patches are deployed

Patch Information

The fix is available in the mainline Linux kernel through two stable-tree commits: 0735c54804c709d1b292f3b6947cfb560b2ce552 and 0cd028806efc148a75d4acf711d21db335a89661. The patch moves unmap error handling into iommu_map_nosync() and reorders operations so trace_map() and iommu_debug_map() record the partial mapping before the immediate unmap. Distribution maintainers backport these commits into supported kernel branches.

Workarounds

Disable CONFIG_IOMMU_DEBUG in kernel builds where the debug instrumentation is not required
Limit local login access and enforce least-privilege on systems that cannot be patched immediately
Rebuild affected kernels from source with the referenced commits cherry-picked if vendor packages are delayed

bash

# Verify kernel version and IOMMU debug configuration
uname -r
grep CONFIG_IOMMU_DEBUG /boot/config-$(uname -r)

# Apply distribution kernel updates (Debian/Ubuntu)
sudo apt update && sudo apt install --only-upgrade linux-image-$(uname -r)

# Apply distribution kernel updates (RHEL/CentOS/Fedora)
sudo dnf update kernel

# Reboot to activate the patched kernel
sudo reboot