CVE-2026-64293: Linux Kernel Buffer Overflow Vulnerability

CVE-2026-64293 Overview

CVE-2026-64293 is a Linux kernel vulnerability in the iommufd subsystem's virtual event queue (vEVENT) read path. The bound-check in iommufd_veventq_fops_read() uses sizeof(hdr) instead of sizeof(*hdr), where hdr is a pointer to struct iommufd_vevent_header. On 32-bit systems, this evaluates to 4 bytes rather than the intended header size, causing the check to under-count by 4 bytes. A local attacker can trigger a copy operation that writes past the user-supplied buffer boundary.

Critical Impact
Local users can trigger out-of-bounds writes in the iommufd veventq read path on 32-bit Linux kernels, leading to memory corruption, potential privilege escalation, or kernel-space information disclosure.

Affected Products

Linux kernel iommufd subsystem containing the iommufd_veventq_fops_read() function
32-bit Linux kernel builds where sizeof(void *) equals 4
Kernel versions prior to the commits 04a177f, 0cdbb97, and be93d18

Discovery Timeline

2026-07-25 - CVE-2026-64293 published to NVD
2026-07-30 - Last updated in NVD database

Technical Details for CVE-2026-64293

Vulnerability Analysis

The vulnerability resides in the iommufd_veventq_fops_read() function within the Linux kernel's iommufd (IOMMU file descriptor) subsystem. The subsystem exposes a virtual event queue (vEVENT) that userspace can read to receive IOMMU-related events. Each event consists of a fixed-size header (struct iommufd_vevent_header) followed by a variable-length payload described by data_len.

The faulty bound-check is:

if (!vevent_for_lost_events_header(cur) &&
    sizeof(hdr) + cur->data_len > count - done) {

Because hdr is declared as struct iommufd_vevent_header *, sizeof(hdr) returns the size of a pointer rather than the size of the structure. On 64-bit platforms, struct iommufd_vevent_header is currently 8 bytes and matches the pointer width, so the check works coincidentally. On 32-bit platforms, the check under-counts the header by 4 bytes.

Root Cause

The root cause is an incorrect use of sizeof on a pointer variable rather than the pointed-to structure. Surrounding code in the same function consistently uses sizeof(*hdr) for the initial size check, the copy_to_user() call, and the done counter increment. The single occurrence of sizeof(hdr) breaks this pattern and produces an inconsistent bound calculation. This is classified as an Out-of-Bounds Write triggered by an incorrect input validation boundary calculation.

Attack Vector

A local, low-privileged user with access to the iommufd character device can craft a read request whose count value sits in the narrow window where 4 + cur->data_len <= count - done but 8 + cur->data_len > count - done. The bound-check passes, then the loop copies 8 bytes of header followed by data_len bytes of payload into the user buffer, writing past its end. The attack is local, requires low privileges, and needs no user interaction, but only affects systems where the pointer width differs from the header size (32-bit builds today, or any future header expansion beyond pointer width).

No public exploit is available. Technical details are documented in the kernel fix commit 04a177f.

Detection Methods for CVE-2026-64293

Indicators of Compromise

Unexpected kernel oops, panic, or stack-protector warnings originating from iommufd_veventq_fops_read in dmesg or /var/log/kern.log
Processes with access to /dev/iommu or iommufd file descriptors performing unusually small read() calls against vEVENT queues
KASAN reports flagging out-of-bounds writes in the iommufd module on 32-bit kernels

Detection Strategies

Inventory hosts running 32-bit Linux kernels with CONFIG_IOMMUFD enabled and cross-reference against the fixed commit hashes.
Enable KASAN (Kernel Address Sanitizer) in test environments to catch out-of-bounds writes during fuzzing of the iommufd interface.
Monitor auditd rules for open() and ioctl() activity against iommufd devices from unexpected UIDs or containers.

Monitoring Recommendations

Collect kernel logs centrally and alert on crashes referencing iommufd_veventq_fops_read or nearby symbols.
Track kernel version and patch status across the fleet, prioritizing 32-bit builds and virtualization hosts that expose iommufd to guests.
Log userspace access to /dev/iommu and correlate with subsequent kernel instability.

How to Mitigate CVE-2026-64293

Immediate Actions Required

Apply the upstream Linux kernel patches from commits 04a177f91160ee18da98f5689482cf0f589ec869, 0cdbb97a4dbd69abdd2ab998b4fbc7803d4b0b72, and be93d186ae88a92e7aa77e122d4e661fa57b1e39 or update to a distribution kernel that includes them.
Prioritize patching 32-bit kernel deployments where the out-of-bounds write is reachable in practice.
Restrict access to iommufd character devices to trusted service accounts using standard filesystem permissions.

Patch Information

The fix replaces sizeof(hdr) with sizeof(*hdr) in the bound-check inside iommufd_veventq_fops_read(), aligning the check with the actual number of bytes copied to user space. Reference commits: 04a177f, 0cdbb97, and be93d18.

Workarounds

Disable CONFIG_IOMMUFD in kernel builds where the feature is not required.
Deny non-root access to iommufd device nodes via udev rules or seccomp policies until the patch is applied.
On multi-tenant hosts, avoid exposing iommufd to untrusted VMs or containers on unpatched 32-bit kernels.

bash

# Verify running kernel and iommufd configuration
uname -r -m
grep CONFIG_IOMMUFD /boot/config-$(uname -r)
ls -l /dev/iommu 2>/dev/null
# Restrict access until patched
chmod 600 /dev/iommu