CVE-2026-64290 Overview
CVE-2026-64290 is a Linux kernel vulnerability in the iommufd subsystem. The flaw resides in the iommufd_fault_fops_read() function, where a failure inside the inner list_for_each_entry loop only breaks the inner iteration. The outer while loop then re-fetches the just-restored fault group and retries the failing copy_to_user() indefinitely. This behavior spins the reader thread at 100% CPU while holding fault->mutex, producing a denial-of-service condition on affected systems. The upstream fix checks rc after the inner loop and breaks the outer while loop as well.
Critical Impact
A local reader triggering a copy_to_user() failure causes an infinite CPU-bound loop holding fault->mutex, blocking legitimate iommufd fault handling.
Affected Products
- Linux kernel versions containing the iommufd fault reporting file operations
- Distributions shipping the pre-patch iommufd_fault_fops_read() implementation
- Systems using IOMMU userspace fault delivery via the iommufd interface
Discovery Timeline
- 2026-07-25 - CVE-2026-64290 published to NVD
- 2026-07-30 - Last updated in NVD database
Technical Details for CVE-2026-64290
Vulnerability Analysis
The issue is a control-flow defect in the kernel's iommufd fault reporting read handler. When user space reads from the fault file descriptor, the kernel iterates fault groups and copies pending faults to the user buffer using copy_to_user(). If that copy fails, for example due to an invalid user pointer, the inner loop breaks and the failing fault group is restored to the pending list. The outer while loop then observes the list as non-empty, re-selects the same restored group, and repeats the failing copy. The read syscall never returns.
Because the loop holds fault->mutex throughout, any other thread attempting to interact with the same fault object stalls. The reader also consumes an entire CPU core, degrading system responsiveness. This qualifies as a resource exhaustion and denial-of-service condition [CWE-835-adjacent loop with unreachable exit].
Root Cause
The root cause is a missing propagation of the inner loop's error status to the outer loop. The rc value set on copy_to_user() failure is not checked after the inner list_for_each_entry terminates, so the outer termination condition never triggers on error.
Attack Vector
A local user with access to an iommufd file descriptor can trigger the condition by supplying a user buffer that causes copy_to_user() to fail while faults are queued. Exploitation requires the ability to open and read from the iommufd fault fd. The result is a hung reader thread and a locked fault object, not code execution or privilege escalation.
No verified public exploit code is available. The vulnerability is described in the upstream commits referenced in the Kernel Git Commit 172fc8b, Kernel Git Commit 5539da1, and Kernel Git Commit f66c16b.
Detection Methods for CVE-2026-64290
Indicators of Compromise
- A kernel thread or user process consuming 100% CPU inside iommufd_fault_fops_read visible in perf top or /proc/<pid>/stack.
- Processes blocked on fault->mutex when interacting with an iommufd fault file descriptor.
- Unresponsive iommufd-managed device passthrough workloads on an otherwise healthy host.
Detection Strategies
- Sample kernel stacks with perf or bpftrace and alert on repeated frames in iommufd_fault_fops_read combined with sustained CPU usage.
- Correlate high system CPU on processes holding open file descriptors under /dev/iommu or iommufd fault fds.
- Monitor for read syscalls against iommufd fault fds that never return within expected latency windows.
Monitoring Recommendations
- Collect kernel version inventory and flag hosts running unpatched kernels that expose iommufd to unprivileged or semi-privileged workloads.
- Track process CPU time and syscall duration for workloads that use IOMMU userspace fault handling, such as VFIO-based virtualization stacks.
- Alert on repeated EFAULT return paths from iommufd file operations if such tracing is enabled.
How to Mitigate CVE-2026-64290
Immediate Actions Required
- Apply the upstream kernel patches referenced in the commits 172fc8b, 5539da1, and f66c16b or update to a distribution kernel that includes them.
- Restrict access to iommufd device nodes to trusted users and services only.
- Audit workloads that consume iommufd fault fds and confirm they pass valid user buffers to read().
Patch Information
The fix adds a check of rc after the inner list_for_each_entry loop and breaks the outer while when the copy failed. The corrected control flow prevents the reader from retrying the same failing copy_to_user() indefinitely. Refer to Kernel Git Commit 172fc8b, Kernel Git Commit 5539da1, and Kernel Git Commit f66c16b for the exact changes and stable-tree backports.
Workarounds
- Limit permissions on /dev/iommu and related iommufd device nodes so only vetted virtualization services can open them.
- Disable or avoid IOMMU userspace fault delivery on hosts that do not require it until the patched kernel is deployed.
- If a stuck reader is observed, terminate the offending process to release fault->mutex and restore fault handling for other consumers.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
