CVE-2026-64291: iommufd: Set veventq_depth upper bound
In the Linux kernel, the following vulnerability has been resolved:
iommufd: Set veventqdepth upper bound
iommufdveventqalloc() accepts any !0 veventqdepth from userspace, with an upper bound at U32MAX.
This leaves a vulnerability where userspace can allocate excessively large queues to exhaust kernel memory reserves.
Cap the veventqdepth (maximum number of entries) to 1 << 19, matching the maximum number of entries in the SMMUv3 EVTQ (the largest use case today).
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Cap userspace-provided veventq_depth (maximum number of entries) to 1 << 19 to prevent excessive allocation that can exhaust kernel memory reserves.
iommufd (iommufd_veventq_alloc / veventq_depth) veventq_depth upper bound = 1 << 19
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user that can invoke iommufd and request a virtual event queue can exploit it. The CVSS vector indicates low privileges are required and no user interaction is needed.
What is the practical impact of exploitation?
An attacker can request an excessively large nonzero veventq_depth, causing allocation of large queues and exhausting kernel memory reserves. This can result in a denial of service through loss of availability.
What limit does the fix impose?
The fix caps veventq_depth at 1 << 19 entries. This matches the maximum entry count of the SMMUv3 EVTQ, identified as the largest current use case.