CVE-2026-64186: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64186 Overview

CVE-2026-64186 is a Linux kernel vulnerability in the AMD Input-Output Memory Management Unit (IOMMU) debugfs implementation. The flaw exists in the iommu_mmio_write() and iommu_capability_write() functions. The variables dbg_mmio_offset and dbg_cap_offset are declared as signed int but populated using kstrtou32_from_user(). A sufficiently large user-supplied value becomes a negative integer, creating conditions for a latent out-of-bounds memory access. Existing size checks and implicit type promotion previously masked the issue, but the underlying parsing was unsafe. The kernel maintainers have resolved the vulnerability by switching to kstrtos32_from_user() and adding explicit negative value checks.

Critical Impact
A local user with access to AMD IOMMU debugfs entries could supply crafted numeric input that bypasses bounds checks, leading to potential out-of-bounds memory access in kernel context.

Affected Products

Linux kernel builds that enable AMD IOMMU debugfs
Systems using AMD processors with IOMMU enabled and CONFIG_AMD_IOMMU_DEBUGFS
Distributions shipping affected upstream kernel versions prior to the referenced fix commits

Discovery Timeline

2026-07-19 - CVE-2026-64186 published to the National Vulnerability Database (NVD)
2026-07-19 - Last updated in NVD database

Technical Details for CVE-2026-64186

Vulnerability Analysis

The vulnerability resides in the AMD IOMMU debugfs interface, which exposes mmio and capability write handlers for kernel debugging. Both handlers accept a numeric offset from user space and use it to index into hardware register regions.

The offset variables dbg_mmio_offset and dbg_cap_offset are declared as signed int. The code parses user input with kstrtou32_from_user(), which produces an unsigned 32-bit value. When that unsigned value exceeds INT_MAX, assigning it into a signed int yields a negative number. Downstream bounds checks compare the signed offset against an unsigned 64-bit register range end, and integer promotion rules can allow the comparison to succeed for negative values, permitting an out-of-bounds indexing condition [CWE-125].

Exploitation requires local access to the debugfs mount point, which is typically restricted to privileged users. The scope of impact is therefore limited to environments where debugfs is exposed to lower-privileged accounts.

Root Cause

The root cause is a type mismatch between the parsing routine and the storage variable. kstrtou32_from_user() returns unsigned values, but the destination is signed. Sanity checks did not explicitly reject negative values, relying instead on the OFS_IN_SZ length limit and implicit promotion during range comparisons.

Attack Vector

An attacker with local access and permissions to write to /sys/kernel/debug/iommu/amd/* supplies a numeric string that resolves to a value above INT_MAX. The signed offset variable then holds a negative number that can be used to compute an out-of-bounds memory reference within the IOMMU register mapping.

No verified proof-of-concept code is publicly available. Refer to the upstream kernel commits for technical details: 488d2c76bd9f, 62f9dfbf1ace, and 8dfd3d8d7443.

Detection Methods for CVE-2026-64186

Indicators of Compromise

Unexpected writes to /sys/kernel/debug/iommu/amd/mmio or /sys/kernel/debug/iommu/amd/capability from non-administrative users
Kernel log entries referencing invalid IOMMU offsets or debugfs read failures
Unusual processes accessing debugfs on production AMD systems where debugging is not expected

Detection Strategies

Audit kernel version output from uname -r against distribution advisories referencing the fix commits
Monitor auditd rules for open and write syscalls targeting AMD IOMMU debugfs paths
Correlate debugfs write activity with the invoking user identity and parent process

Monitoring Recommendations

Ensure debugfs is mounted only where necessary and restrict permissions to root-only access
Track kernel warnings and stack traces originating from iommu/amd code paths
Baseline expected debugfs activity in build and lab environments to detect deviations in production

How to Mitigate CVE-2026-64186

Immediate Actions Required

Update to a Linux kernel that incorporates the fix commits 488d2c76bd9f, 62f9dfbf1ace, or 8dfd3d8d7443
Restrict access to /sys/kernel/debug to root only, or unmount debugfs on systems where it is not required
Review kernel configurations and disable CONFIG_AMD_IOMMU_DEBUGFS in production builds where feasible

Patch Information

The upstream fix replaces kstrtou32_from_user() with kstrtos32_from_user() and adds explicit checks for negative values in both iommu_mmio_write() and iommu_capability_write(). Consult the stable tree commits linked under Technical References and coordinate with your Linux distribution vendor for backported packages.

Workarounds

Unmount debugfs with umount /sys/kernel/debug on hosts that do not require kernel debugging
Set restrictive mount options limiting debugfs access to the root user only
Remove or disable the AMD IOMMU debugfs interface from custom kernel builds prior to upgrading

bash

# Configuration example
# Restrict debugfs to root only at mount time
mount -o remount,mode=700,uid=0,gid=0 /sys/kernel/debug

# Verify current running kernel version before and after patching
uname -r