CVE-2026-68324: iommu/intel: Fix out-of-bounds memset in dmar_latency_disable()
In the Linux kernel, the following vulnerability has been resolved:
iommu/intel: Fix out-of-bounds memset in dmarlatencydisable()
dmarlatencydisable() intends to zero out only the single latencystatistic entry for the given type, but the memset size was computed as sizeof(lstat) DMARLATENCYNUM, which clears the entire array starting from &lstat[type].
When type > 0, this writes beyond the end of the allocated array, corrupting adjacent memory.
Fix by using sizeof(lstat) to clear only the target entry.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Modify dmar_latency_disable() so the out-of-bounds memset is corrected by using sizeof(*lstat) to clear only the single latency_statistic entry for the given type, rather than using sizeof(*lstat) * DMAR_LATENCY_NUM which corrupts adjacent memory by clearing beyond the allocated array starting from &lstat[type].
Linux kernel dmar_latency_disable() memset size = sizeof(*lstat) to clear only the target entry (latency_statistic entry) instead of clearing the entire array
Event History
Frequently Asked Questions
What is the severity of CVE-2026-68324?
CVE-2026-68324 has a risk rating of 41, indicating a medium level of severity.
How do I fix CVE-2026-68324?
To fix CVE-2026-68324, update your Linux kernel to the latest version where the vulnerability has been patched.
What systems are affected by CVE-2026-68324?
CVE-2026-68324 affects systems running an affected version of the Linux kernel with Intel IOMMU support.
What impact does CVE-2026-68324 have on my system?
CVE-2026-68324 could lead to out-of-bounds memory writes, potentially compromising system integrity and stability.
Is CVE-2026-68324 a critical vulnerability?
CVE-2026-68324 is not classified as critical but poses risks that warrant timely response and remediation.