CVE-2026-64291: Linux Kernel IOMMUFD DOS Vulnerability

CVE-2026-64291 Overview

CVE-2026-64291 is a Linux kernel vulnerability in the iommufd subsystem. The iommufd_veventq_alloc() function accepts any non-zero veventq_depth value from userspace, capped only at U32_MAX. Userspace callers can request excessively large virtual event queues, exhausting kernel memory reserves. The fix caps veventq_depth at 1 << 19, matching the maximum entries used by the ARM System Memory Management Unit v3 (SMMUv3) Event Queue (EVTQ).

Critical Impact
Local userspace processes with access to the iommufd interface can trigger kernel memory exhaustion, leading to denial of service on affected Linux systems.

Affected Products

Linux kernel versions containing the iommufd virtual event queue (veventq) implementation prior to the fix
Distributions shipping the affected iommufd subsystem code
Systems exposing iommufd to unprivileged or containerized workloads

Discovery Timeline

2026-07-25 - CVE-2026-64291 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64291

Vulnerability Analysis

The vulnerability resides in iommufd_veventq_alloc(), part of the Linux kernel's iommufd (IOMMU file descriptor) subsystem. This subsystem manages Input-Output Memory Management Unit (IOMMU) resources for userspace consumers such as virtualization stacks.

When userspace allocates a virtual event queue (veventq), it supplies a veventq_depth parameter. The kernel validated only that this value was non-zero, allowing sizes up to U32_MAX entries. A malicious or misbehaving process can request queues large enough to exhaust kernel memory reserves.

The issue is a resource-exhaustion class defect. There is no memory corruption or code execution, but sustained allocations can starve the kernel and destabilize the host.

Root Cause

The root cause is missing input validation on a size parameter received from userspace. The allocator applied no realistic upper bound, so veventq_depth could scale to values far beyond any legitimate hardware use case. The maximum entry count of the SMMUv3 Event Queue, the largest legitimate consumer, is 1 << 19 (524,288). Accepting values several orders of magnitude larger than this created an unbounded memory allocation path.

Attack Vector

An attacker requires local access to the iommufd interface. On systems that expose iommufd to unprivileged containers, virtual machine managers, or non-root users, a malicious process can call the allocation ioctl with a very large veventq_depth value. Repeated or sufficiently large allocations exhaust kernel memory and trigger denial-of-service conditions, including OOM (out-of-memory) killer activity and system unresponsiveness.

The upstream fix caps veventq_depth at 1 << 19, aligning the limit with the largest realistic hardware queue. See the kernel commits 6ebf2eb46fbd, e7b5e5565274, and f565297edf31 for the applied changes.

Detection Methods for CVE-2026-64291

Indicators of Compromise

Repeated OOM killer events targeting kernel-allocating workloads on hosts exposing iommufd
Unexplained growth in kernel slab allocations attributable to iommufd structures
Processes issuing high-frequency iommufd ioctls with unusually large veventq_depth arguments

Detection Strategies

Audit iommufd ioctl calls using auditd or eBPF-based tracing to capture veventq_depth argument values
Correlate kernel memory pressure metrics with process activity performing iommufd operations
Track kernel log entries related to allocation failures, OOM kills, and iommufd subsystem warnings

Monitoring Recommendations

Alert on kernel memory usage anomalies on hypervisor and container hosts that expose iommufd
Baseline legitimate virtualization workloads and flag deviations in ioctl argument distributions
Forward kernel logs to a centralized analytics platform for retrospective analysis of DoS events

How to Mitigate CVE-2026-64291

Immediate Actions Required

Apply the upstream kernel patches referenced in the stable tree commits listed in the NVD entry
Restrict access to the iommufd character device to trusted users and workloads only
Review container and virtualization runtime configurations that grant access to iommufd

Patch Information

The fix caps veventq_depth at 1 << 19 entries inside iommufd_veventq_alloc(). Kernel maintainers backported the change across stable branches in commits 6ebf2eb46fbd, e7b5e5565274, and f565297edf31. Upgrade to a kernel build that includes these commits or a distribution-provided package incorporating the fix.

Workarounds

Deny access to /dev/iommu for untrusted users via device permissions or MAC policies (SELinux, AppArmor)
Disable iommufd in kernel configuration where userspace IOMMU management is not required
Constrain memory available to workloads through cgroup v2 memory.max limits to reduce blast radius

bash

# Restrict /dev/iommu access to a trusted group
chown root:iommu-users /dev/iommu
chmod 0660 /dev/iommu

# Confirm the running kernel includes the fix commit
zgrep -E 'iommufd|veventq' /proc/config.gz
uname -r