CVE-2026-64289: Linux Kernel IOMMUFD DoS Vulnerability

CVE-2026-64289 Overview

CVE-2026-64289 is a denial-of-service vulnerability in the Linux kernel's iommufd subsystem. The flaw lives in iommufd_hwpt_invalidate(), which accepts user-controlled entry_num and entry_len parameters bounded only by U32_MAX. Attackers with access to the iommufd ioctl interface can supply oversized values that force the kernel into long, non-preemptible loops. The result is a soft-lockup watchdog trip and CPU stall on the affected core. The issue was resolved by capping entry_len under PAGE_SIZE and entry_num under 1 << 19 inside the ioctl handler.

Critical Impact
Local users with access to iommufd can stall CPUs by triggering multi-gigabyte user-memory scans or unbounded backend invalidation loops, producing kernel soft lockups.

Affected Products

Linux kernel builds exposing the iommufd subsystem prior to the fix commits
Distributions shipping iommufd_hwpt_invalidate() without upper bounds on entry_num and entry_len
Virtualization hosts using the VT-d nested invalidation handler through iommufd

Discovery Timeline

2026-07-25 - CVE-2026-64289 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64289

Vulnerability Analysis

The iommufd_hwpt_invalidate() ioctl processes user-supplied cache invalidation requests for hardware page tables. It reads two attacker-controlled integers, entry_num and entry_len, each accepted up to U32_MAX. Neither value is checked against practical hardware or memory limits before use.

When entry_len exceeds the kernel's expected struct size, the copy helper enters a verification path that scans the surplus bytes to confirm they are zero. Against multi-gigabyte zeroed user memory, this scan runs in one uninterruptible pass and trips the soft-lockup watchdog.

A large entry_num drives the backend invalidation loop with no reschedule point. The VT-d nested handler copies each entry and flushes caches per iteration, pinning the CPU on a non-preemptible kernel path. This is a resource exhaustion and algorithmic complexity issue rather than a memory corruption bug.

Root Cause

The root cause is missing upper-bound validation on user-supplied ioctl parameters. Bounding the values only by U32_MAX allows requests that are orders of magnitude larger than any legitimate hardware invalidation batch. Combined with a non-preemptible processing loop, this converts unbounded input into CPU exhaustion.

Attack Vector

A local user with permission to open /dev/iommu and issue IOMMU_HWPT_INVALIDATE ioctls can trigger the condition. The attacker crafts an ioctl call with either an entry_len far above the request struct size backed by zeroed user memory, or a very large entry_num, or both. The kernel then enters a long uninterruptible loop, producing soft lockups and degrading host responsiveness. See the fix commits linked below for the exact bounding logic.

The vulnerability is described in prose because no public proof-of-concept code is available. Technical details are documented in Kernel Git Commit 2c6381d, Kernel Git Commit 32ca4ae, Kernel Git Commit 4d70986, and Kernel Git Commit d2bd041.

Detection Methods for CVE-2026-64289

Indicators of Compromise

Kernel log entries reporting soft lockup - CPU#N stuck with call traces referencing iommufd_hwpt_invalidate or VT-d nested invalidation handlers.
Unexpected CPU pinning at 100% in kernel mode on hosts exposing /dev/iommu to unprivileged workloads or guests.
Repeated IOMMU_HWPT_INVALIDATE ioctls from a single process with abnormally large entry_num or entry_len values.

Detection Strategies

Enable and monitor kernel.softlockup_panic and related watchdog telemetry, correlating stall stack traces with iommufd symbols.
Audit processes issuing ioctls to /dev/iommu using auditd rules on the character device.
Track kernel version and package inventory to identify hosts running iommufd builds without the bounding patches.

Monitoring Recommendations

Alert on watchdog: BUG: soft lockup messages in dmesg and forward them to a centralized log store for correlation.
Monitor VM hosts using VT-d nested translation for sustained per-core kernel CPU time originating from IOMMU code paths.
Track ioctl syscall rates against iommufd handles per process and flag statistical outliers.

How to Mitigate CVE-2026-64289

Immediate Actions Required

Update to a Linux kernel that includes the iommufd bounding commits 2c6381d, 32ca4ae, 4d70986, or d2bd041 from the stable tree.
Restrict access to /dev/iommu so that only trusted virtualization services and administrators can issue IOMMU_HWPT_INVALIDATE ioctls.
Rebuild custom kernels or hardened distributions against a fixed upstream base before redeploying.

Patch Information

The fix caps entry_len under PAGE_SIZE, above any request struct, and entry_num under 1 << 19, the order of a hardware invalidation queue. Apply the stable-tree commits 2c6381d, 32ca4ae, 4d70986, and d2bd041, or install a distribution kernel that incorporates them.

Workarounds

Remove or restrict /dev/iommu permissions on hosts that do not require user-space IOMMU management.
Disable exposure of iommufd to untrusted guests or containers until the patched kernel is deployed.
Where feasible, disable VT-d nested translation features that route through the vulnerable invalidation path.

bash

# Configuration example: restrict access to /dev/iommu to a trusted group
sudo groupadd iommu-admins
sudo chown root:iommu-admins /dev/iommu
sudo chmod 660 /dev/iommu

# Verify the running kernel includes the fix
uname -r
grep -E 'iommufd|hwpt_invalidate' /proc/kallsyms | head