CVE-2026-64186: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
In iommummiowrite() and iommucapabilitywrite(), the variables dbgmmiooffset and dbgcapoffset are declared as int. However, they are populated using kstrtou32fromuser(). If a user provides a sufficiently large value, it can become a negative integer.
Prior to this patch, the AMD IOMMU debugfs implementation was already protected by different mechanisms.
1. #define OFSINSZ 8 ensures the user string <= 8 bytes, so e.g. 0xffffffff isn't a valid input.
if (cnt > OFSINSZ) return -EINVAL;
2. Implicit type promotion in iommummiowrite(), dbgmmiooffset is int and iommu->mmiophysend is u64
if (dbgmmiooffset > iommu->mmiophysend - sizeof(u64)) return -EINVAL;
3. The show handlers would currently catch the negative number and refuse to perform the read.
Replace kstrtou32fromuser() with kstrtos32fromuser() to parse the input, and check for negative values to explicitly prevent out-of-bounds memory accesses directly in iommummiowrite() and iommucapabilitywrite().
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
In iommu_mmio_write() and iommu_capability_write(), replace kstrtou32_from_user() with kstrtos32_from_user() so negative user-provided values are rejected rather than being implicitly promoted to large unsigned values.
Linux kernel IOMMU debugfs kstrtou32_from_user() -> kstrtos32_from_user() parsing = kstrtos32_from_user() - Configuration
In the IOMMU debugfs write handlers (iommu_mmio_write() and iommu_capability_write()), explicitly check for negative values of dbg_mmio_offset (and dbg_cap_offset) and return -EINVAL to prevent out-of-bounds memory accesses.
Linux kernel IOMMU debugfs dbg_mmio_offset/dbg_cap_offset signedness handling = reject negative values (return -EINVAL)
Event History
Frequently Asked Questions
What is the severity of CVE-2026-64186?
The severity of CVE-2026-64186 is rated at 34, indicating a moderate risk level.
How do I fix CVE-2026-64186?
To fix CVE-2026-64186, update your Linux kernel to the latest available version where the vulnerability has been resolved.
What systems are affected by CVE-2026-64186?
CVE-2026-64186 affects the Linux kernel used in systems that utilize AMD IOMMU features.
What are the implications of CVE-2026-64186?
The implications of CVE-2026-64186 include potential out-of-bounds memory access that could lead to system instability or unauthorized access.
Was CVE-2026-64186 publicly disclosed?
Yes, CVE-2026-64186 was publicly disclosed on July 19, 2026.