CVE-2026-64292: Linux Kernel IOMMUFD DoS Vulnerability

CVE-2026-64292 Overview

CVE-2026-64292 is a Linux kernel vulnerability in the iommufd subsystem. The flaw resides in the virtual event queue (veventq) handling code, where memory allocation occurs inside a spinlock. Because the queue depth is controlled from user space, an unprivileged process can request large allocations that consume atomic memory reserves. The upstream fix moves the allocation outside the spinlock and switches to GFP_NOWAIT, allowing the kernel to fail fast under memory pressure rather than depleting GFP_ATOMIC reserves.

Critical Impact
Local users can exhaust kernel atomic memory reserves by submitting oversized veventq depths, producing denial-of-service conditions in the iommufd subsystem and potentially destabilizing unrelated kernel components that depend on atomic allocations.

Affected Products

Linux kernel builds containing the iommufd subsystem prior to the referenced stable commits
Distributions shipping the vulnerable veventq allocation path in drivers/iommu/iommufd/
Systems exposing /dev/iommu to unprivileged or containerized workloads

Discovery Timeline

2026-07-25 - CVE-2026-64292 published to the National Vulnerability Database (NVD)
2026-07-30 - Last updated in the NVD database

Technical Details for CVE-2026-64292

Vulnerability Analysis

The iommufd subsystem provides user-space control over IOMMU (Input-Output Memory Management Unit) operations, including a veventq mechanism that delivers virtual events to user space. The queue depth parameter is set by user space when the queue is created.

The defective code path allocated memory for each new event while holding a spinlock. Allocation under a spinlock must not sleep, so the allocator falls back to atomic reserves. When user space requests a very large queue depth, repeated allocations under the lock drain the GFP_ATOMIC reserve. Because atomic reserves are shared kernel-wide, exhaustion affects unrelated subsystems that depend on them, producing broader instability.

Root Cause

The root cause is a design flaw combining user-controlled sizing with allocation under a spinlock [CWE-770: Allocation of Resources Without Limits or Throttling]. The veventq depth was neither capped nor validated against a safe upper bound, and the allocation was performed inside a critical section that forbids sleeping. The fix relocates the allocation outside the spinlock and uses GFP_NOWAIT so that pressure results in a fast failure rather than reserve depletion.

Attack Vector

A local attacker with access to the /dev/iommu interface opens an iommufd handle and creates a veventq with a large user-specified depth. By triggering events that populate the queue, the attacker forces repeated in-lock allocations that consume atomic memory. On failure, the corrected code queues a lost_events_header and returns -ENOMEM to signal kernel-side memory pressure to the caller. The mitigation is distinct from the queue-overflow path, which returns 0 because a full queue is an expected pacing condition.

See the upstream fixes at commit 47443565d10c, commit 6c5fc40200cd, and commit 779480ea7955.

Detection Methods for CVE-2026-64292

Indicators of Compromise

Kernel log entries reporting -ENOMEM returns from iommufd event delivery paths.
Sudden appearance of lost_events_header markers in iommufd consumers.
Unprivileged or container processes holding open file descriptors to /dev/iommu with large veventq allocations.

Detection Strategies

Monitor dmesg and journal output for atomic allocation failures and page allocation failure warnings correlated with iommufd activity.
Audit which processes open /dev/iommu and correlate against expected virtualization or DPDK workloads.
Track kernel version and package inventory to identify hosts running builds prior to the patched stable commits.

Monitoring Recommendations

Alert on repeated GFP_ATOMIC allocation failures observed in kernel telemetry.
Collect and forward kernel logs to a central data lake for longitudinal correlation with process ancestry.
Baseline normal iommufd usage per host so anomalous veventq creation patterns can be flagged.

How to Mitigate CVE-2026-64292

Immediate Actions Required

Apply the upstream stable-tree patches referenced by the iommufd: Move vevent memory allocation outside spinlock commit series.
Update to a distribution kernel that incorporates the fix once available from the vendor.
Restrict access to /dev/iommu to trusted service accounts and virtualization stacks only.

Patch Information

The fix is committed to the Linux stable tree in three related commits: 47443565d10c, 6c5fc40200cd, and 779480ea7955. The patch moves the veventq allocation outside the spinlock, adopts GFP_NOWAIT to fail fast under memory pressure, and returns -ENOMEM while queuing a lost_events_header so user space is informed of the drop. A follow-up change caps the upper bound of veventq_depth.

Workarounds

Remove or restrict permissions on /dev/iommu for untrusted users and containers until the patched kernel is deployed.
Disable iommufd features in the kernel configuration (CONFIG_IOMMUFD) on hosts that do not require user-space IOMMU management.
Use mandatory access control policies such as SELinux or AppArmor to constrain which processes can open the iommufd character device.

bash

# Configuration example
# Restrict /dev/iommu access to a dedicated group and audit usage
sudo groupadd iommufd
sudo chgrp iommufd /dev/iommu
sudo chmod 0660 /dev/iommu

# Verify running kernel includes the fix commits
uname -r
git -C /usr/src/linux log --oneline | grep -E '47443565d10c|6c5fc40200cd|779480ea7955'