Look up another CVE · open CVE-2026-64293 in the interactive tracker
CVE-2026-64293
iommufd: Use sizeof(*hdr) instead of sizeof(hdr) in veventq read
Published 2026-07-25 (3 months ago) by the Linux kernel CNA. Subsystem drivers/iommu. Debian urgency: unimportant.
What to do, per Debian release
Debian's own status for CVE-2026-64293 in every release this site tracks, and what each one means in practice. Every status below is the one the Debian Security Team publishes for this CVE. source
| Release | Status | Version | What this means |
|---|---|---|---|
| Debian 12bookworm | not affected | 6.1.190-1 | Nothing to do. bookworm never shipped the vulnerable code. |
| Debian 13trixie | not affected | 6.12.113-1 | Nothing to do. trixie never shipped the vulnerable code. |
| Debian 14forky | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
| Debian unstablesid | fixed | 7.1.4-1 | Update the kernel and reboot. Fixed in 7.1.4-1. A running kernel keeps the old code until the machine restarts. |
The vulnerability
What the bug is
The bound-check in iommufd_veventq_fops_read() for the normal vEVENT path uses sizeof(hdr) where the surrounding code uses sizeof(*hdr): if (!vevent_for_lost_events_header(cur) && sizeof(hdr) + cur->data_len > count - done) { hdr is declared as struct iommufd_vevent_header *, so sizeof(hdr) evaluates to the size of the pointer. Surrounding code uses sizeof(*hdr) consistently: if (done >= count || sizeof(*hdr) > count - done) { ... if (copy_to_user(buf + done, hdr, sizeof(*hdr))) { ... done += sizeof(*hdr); struct iommufd_vevent_header is currently 8 bytes (two __u32 fields, flags and sequence), so on 64-bit (sizeof(void *) == 8) the two expressions happen to be equal and the check works as intended. On 32-bit (sizeof(void *) == 4) the check under-counts the header by 4 bytes: a vEVENT whose data_len causes 8 + cur->data_len to exceed count - done while 4 + cur->data_len does not will pass the check, then the loop will copy_to_user 8 bytes of header followed by data_len bytes of payload, writing past the user-supplied buffer. It is also a latent bug for any future expansion of struct iommufd_vevent_header beyond sizeof(void *) on 64-bit; the check should not depend on the type happening to match the host pointer width. Use sizeof(*hdr) to match the rest of the function and the actual amount that will be copied.
Where it lives
The fix touches these files. If the subsystem is one you do not use, the practical exposure is lower, though the package is still the vulnerable one.
drivers/iommu/iommufd/eventq.c
- What this is
- IOMMUFDMAINTAINERS section matched on drivers/iommu/iommufd/ · iommu@lists.linux.dev · Maintained
Check it on the machine
grep -w CONFIG_IOMMUFD /boot/config-$(uname -r)Reads the booted kernel's own configuration, on the machine and nowhere else. =y is built in, =m is a module, and an is not set line means the code is not there.
Show whether Debian builds this, per release
Debian does not build this code in 2 releases. The build rule could not be established for 2 releases, so nothing is claimed about those.
- bookworm, trixie?
- forky, sidn
- ?
- not established - no Makefile entry for the affected file
- n
- not enabled on any flavour - this release does not build the code
Where a release above reads "not established", no build rule for the affected file was found in that release's kernel tree. That is a gap in this lookup, not a finding that the code is absent.
- Build switch
- CONFIG_IOMMUFD
From the configuration Debian publishes for every kernel flavour it builds. It covers only the architectures Debian ships a linux-config package for, and nothing about a kernel you built yourself. Debian's own status above stays authoritative about the source package.MAINTAINERS kbuild Makefiles Debian linux-config packages
Signals
- Published
- 2026-07-25 (3 months ago)source
- CVSS
- 7.8 high
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsource recompute it - Attack vector
- local (AV:L)source
- EPSS
- 0.17%, higher than 5.5% of all CVEssource
- CISA KEV
- not listedthe KEV catalogue
- Debian urgency
- unimportantsource
- Subsystem
- drivers/iommu
Upstream fixes
The versions the CNA records as introducing and fixing this, and the commit for each. source
| Introduced | Fixed in | Commit |
|---|---|---|
| 6.15 | 6.18.39 | 04a177f91160 |
| 6.15 | 7.1.4 | 0cdbb97a4dbd |
| 6.15 | 7.2 | be93d186ae88 |
Why the CNA scored it this way
Quoted from the kernel CNA's own scoring file, word for word. A highlighted metric carries the most severe value CVSS v3.1 defines for it, which is what pushes the score up. source
- AV:LAttack vector, local
- The vulnerable function is reached through read() on a locally held iommufd vEVENTQ file descriptor; it is not directly network- or device-packet-facing.
- AC:LAttack complexity, low
- On an affected 32-bit deployment, the attacker can deterministically queue an event and choose a count that is one to four bytes too small; no race or uncontrollable condition is required.
- PR:LPrivileges required, low
- No capability check occurs during the vulnerable read, and an unprivileged VMM or user granted an iommufd/vEVENTQ descriptor can invoke it without real init-namespace root.
- UI:NUser interaction, none
- Exploitation requires only attacker-controlled event generation and a read syscall; no separate victim action is required.
- S:UScope, unchanged
- The corruption occurs through the host kernel's userspace API and does not itself bypass an IOMMU boundary or demonstrate a guest-to-host escape.
- C:HConfidentiality impact, high
- The four-byte overwrite can replace a complete pointer or control word in a 32-bit event consumer, potentially enabling code execution and disclosure of arbitrary process secrets.
- I:HIntegrity impact, high
- The kernel writes up to four payload bytes beyond the declared userspace buffer, which can corrupt a full 32-bit control value and potentially permit control-flow hijacking.
- A:HAvailability impact, high
- The overwrite can crash a privileged VMM or other event-consuming service, and controllable event generation permits the condition to be triggered repeatedly.