CVE-2026-64291: iommufd: Set veventq_depth upper bound

Q: Who can exploit this issue?

A local user that can invoke iommufd and request a virtual event queue can exploit it. The CVSS vector indicates low privileges are required and no user interaction is needed.

Q: What is the practical impact of exploitation?

An attacker can request an excessively large nonzero veventq_depth, causing allocation of large queues and exhausting kernel memory reserves. This can result in a denial of service through loss of availability.

Q: What limit does the fix impose?

The fix caps veventq_depth at 1 << 19 entries. This matches the maximum entry count of the SMMUv3 EVTQ, identified as the largest current use case.

Published Jul 25, 2026

Updated

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Set veventqdepth upper bound

iommufdveventqalloc() accepts any !0 veventqdepth from userspace, with an upper bound at U32MAX.

This leaves a vulnerability where userspace can allocate excessively large queues to exhaust kernel memory reserves.

Cap the veventqdepth (maximum number of entries) to 1 << 19, matching the maximum number of entries in the SMMUv3 EVTQ (the largest use case today).

Affected Software

3 affected components

Linux Linux kernel

Linux Linux kernel>=6.15<6.18.39

Linux Linux kernel>=6.19<7.1.4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Configuration
Cap userspace-provided veventq_depth (maximum number of entries) to 1 << 19 to prevent excessive allocation that can exhaust kernel memory reserves.
iommufd (iommufd_veventq_alloc / veventq_depth) veventq_depth upper bound = 1 << 19

Event History

Jul 25, 2026

CVE Published

via MITRE·08:49 AM

Data Sourced

via MITRE·08:49 AM

Description

Data Sourced

via NVD·10:17 AM

RemedyDescriptionSeverityAffected Software

Frequently Asked Questions

Who can exploit this issue?

A local user that can invoke iommufd and request a virtual event queue can exploit it. The CVSS vector indicates low privileges are required and no user interaction is needed.

What is the practical impact of exploitation?

An attacker can request an excessively large nonzero veventq_depth, causing allocation of large queues and exhausting kernel memory reserves. This can result in a denial of service through loss of availability.

What limit does the fix impose?

The fix caps veventq_depth at 1 << 19 entries. This matches the maximum entry count of the SMMUv3 EVTQ, identified as the largest current use case.

CVE-2026-64291: iommufd: Set veventq_depth upper bound

Affected Software

Remediation

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact of exploitation?

What limit does the fix impose?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact of exploitation?

What limit does the fix impose?