CVE-2026-64291 | In the Linux kernel, the following vulnerability has been re…

Description

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with an upper bound at U32_MAX. This leaves a vulnerability where userspace can allocate excessively large queues to exhaust kernel memory reserves. Cap the veventq_depth (maximum number of entries) to 1 << 19, matching the maximum number of entries in the SMMUv3 EVTQ (the largest use case today).

Metadata

CVE ID: CVE-2026-64291
State: PUBLISHED
Assigner: Linux
Reserved: 2026-07-19 15:36 UTC
Published: 2026-07-25 08:49 UTC
Last updated: 2026-07-25 08:49 UTC
Vendor / Product: Linux / Linux
Sources: cve.org · NVD

Severity & Metrics

No CVSS data available.

Affected products (2)

Vendor	Product	Platform	Versions
Linux	Linux	—	e36ba5ab808ef6237c3148d469c8238674230e2b < f565297edf316016be4a1a9e2eb9f39359313f43, e36ba5ab808ef6237c3148d469c8238674230e2b < e7b5e55652746b1221b9c10ff80eae8a154101ba, e36ba5ab808ef6237c3148d469c8238674230e2b < 6ebf2eb46fbd5b40393ff8fbb847ba96925beaff
Linux	Linux	—	6.15, 0 < 6.15, 6.18.39 ≤ 6.18., 7.1.4 ≤ 7.1. …

References (3)