CVE-2026-68325: Linux Kernel IOMMU Buffer Vulnerability

CVE-2026-68325 Overview

CVE-2026-68325 is a Linux kernel vulnerability in the AMD IOMMU driver. The ivrs_acpihid command-line parser appends entries to a fixed four-element early_acpihid_map array without validating capacity. A fifth entry passed on the kernel boot command line causes an out-of-bounds write past the array bounds. Unlike the sibling IOAPIC and HPET parsers, the ACPI HID parser lacks the capacity check before incrementing the map size. The Linux kernel maintainers have resolved the issue by adding a bounds check at the common found label before parsing the HID and UID or writing the entry.

Critical Impact
A malformed or excessive ivrs_acpihid= kernel command-line argument triggers an out-of-bounds write in the AMD IOMMU early initialization path, corrupting adjacent kernel memory during boot.

Affected Products

Linux kernel (AMD IOMMU driver, drivers/iommu/amd/)
Kernel branches prior to the fixes referenced in the stable commits
Systems using AMD IOMMU with ivrs_acpihid boot parameters

Discovery Timeline

2026-08-10 - CVE-2026-68325 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-68325

Vulnerability Analysis

The vulnerability resides in the AMD IOMMU driver's early ACPI Hardware ID (HID) map handling. The early_acpihid_map is a fixed-size array containing four entries used during early boot to override ACPI HID device mappings for the Input/Output Memory Management Unit (IOMMU). The parser for the ivrs_acpihid= kernel command-line option appends new entries to this array. It fails to check whether the array has remaining capacity before writing.

The sibling parsers for IOAPIC and HPET tables reject entries beyond the fixed capacity. The ACPI HID parser omits this check, allowing writes to occur past the last valid slot. This out-of-bounds write [CWE-787] corrupts kernel memory adjacent to the map, with consequences dependent on kernel layout and configuration.

Root Cause

The root cause is a missing capacity check in the parsing routine. When the parser reaches its common found label after matching an ACPI HID entry, it proceeds to parse the HID and UID and write the entry without confirming that the map still has an available slot. The size counter is then incremented past the array bound.

Attack Vector

Exploitation requires the ability to modify kernel boot parameters. This scope typically includes local administrators, bootloader-modifying attackers, or automated provisioning systems that pass untrusted command-line data. Remote exploitation is not applicable in typical deployments. The vulnerability manifests only during early kernel initialization when ivrs_acpihid= is specified with more than four entries.

Code-level details are documented in the upstream patches. See the kernel commit abe5d796 and related stable backports for the exact fix.

Detection Methods for CVE-2026-68325

Indicators of Compromise

Kernel boot logs containing ivrs_acpihid= entries exceeding four occurrences on the command line.
Early boot crashes, panics, or memory corruption warnings originating from drivers/iommu/amd/init.c.
Unexpected modifications to /proc/cmdline or bootloader configuration files (grub.cfg, /boot/loader/entries/).

Detection Strategies

Audit /proc/cmdline on running hosts to enumerate any use of ivrs_acpihid and count parameter instances.
Compare running kernel version against fixed versions referenced in the stable commits 030a8e84, 1e31d239, abe5d796, e5ebe854, and fb80117f.
Monitor configuration management systems for changes to bootloader parameters that add IOMMU overrides.

Monitoring Recommendations

Alert on writes to GRUB configuration files and systemd-boot loader entries.
Collect and centralize kernel boot logs (dmesg, journalctl -k) for review of IOMMU initialization messages.
Track kernel package versions across the fleet to identify unpatched systems.

How to Mitigate CVE-2026-68325

Immediate Actions Required

Apply the upstream Linux kernel patches from the stable tree commits listed in the references.
Inventory bootloader configurations and remove any ivrs_acpihid= entries beyond four elements.
Restrict write access to bootloader configuration files and the EFI system partition to trusted administrators only.

Patch Information

The fix is upstream in the Linux kernel and backported to stable branches. See the following commits: 030a8e84, 1e31d239, abe5d796, e5ebe854, and fb80117f. The patches add a capacity check at the common found label before parsing the HID and UID or writing the entry.

Workarounds

Remove ivrs_acpihid= overrides from the kernel command line if not required for hardware operation.
Keep the number of ivrs_acpihid entries at or below four until the patched kernel is deployed.
Enforce Secure Boot and signed bootloader configuration to reduce the risk of unauthorized command-line modification.

bash

# Inspect current kernel command line for ivrs_acpihid entries
cat /proc/cmdline | tr ' ' '\n' | grep -c '^ivrs_acpihid='

# Review GRUB configuration for IOMMU parameters
grep -R 'ivrs_acpihid' /etc/default/grub /etc/grub.d/ /boot/grub2/ 2>/dev/null