CVE-2026-64151

Analyzed Analyzed - Analysis Complete

IOMMU Domain Page Size Validation Flaw in Linux Kernel

Publication date: 2026-07-19

Last updated on: 2026-08-17

Assigner: kernel.org

Description

In the Linux kernel, the following vulnerability has been resolved: iommupt: Check for missing PAGE_SIZE in the pgsize_bitmap Sashiko pointed out that the driver could drop PAGE_SIZE from the pgsize_bitmap. That is technically allowed but nothing does it, and such an iommu_domain would not be used with the DMA API today. Still, it is against the design and it is trivial to fix up. Lift the PT_WARN_ON to the if branch and just skip the fast path.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-07-19

Last Modified

2026-08-17

Generated

2026-08-29

AI Q&A

2026-07-19

EPSS Evaluated

2026-08-28

NVD

CVE-2026-64151

EUVD

EUVD-2026-45836

Affected Vendors & Products

Vendor	Product	Version / Range
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	7.1
linux	linux_kernel	From 6.19 (inc) to 7.0.11 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-UNKNOWN

Attack-Flow Graph

Executive Summary

This is a Linux kernel vulnerability where the iommupt driver could incorrectly omit PAGE_SIZE from the pgsize_bitmap. While technically allowed, it violates design expectations and could lead to issues with DMA API usage. The fix involves adjusting the PT_WARN_ON check to skip the fast path when PAGE_SIZE is missing.

Detection Guidance

This vulnerability is specific to the Linux kernel's iommupt driver and does not provide direct detection commands. It involves a missing PAGE_SIZE check in the pgsize_bitmap. Monitoring kernel logs for iommu-related warnings or errors may help identify issues. Check if your kernel version includes the fix by reviewing the driver's source code or kernel changelogs.

Impact Analysis

This vulnerability may cause instability or incorrect behavior in systems using IOMMU with the Linux kernel. It could lead to DMA operations failing or memory access issues if the driver attempts to use an iommu_domain without PAGE_SIZE support.

Compliance Impact

This vulnerability does not directly affect compliance with GDPR, HIPAA, or similar standards. It is a low-level Linux kernel issue related to IOMMU domain handling, which does not involve data privacy, security controls, or protected health information.

Mitigation Strategies

Update the Linux kernel to the latest stable version that includes the fix for this vulnerability. Monitor vendor advisories for kernel patches and apply them promptly.

Hi! I’m here to help you understand CVE-2026-64151. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70