CVE-2026-64292
Received Received - Intake

Memory Allocation Flaw in Linux Kernel iommufd

Publication date: 2026-07-25

Last updated on: 2026-07-25

Assigner: kernel.org

Description
In the Linux kernel, the following vulnerability has been resolved: iommufd: Move vevent memory allocation outside spinlock The veventq memory allocation happens inside the spinlock. Given its depth is decided by the user space, this leaves a vulnerability, where userspace can allocate large queues to exhaust atomic memory reserves. Move the allocation outside the spinlock and use GFP_NOWAIT, which can fail fast under memory pressure without dipping into the GFP_ATOMIC reserves or direct-reclaiming from the threaded IRQ handler. On allocation failure, queue the lost_events_header (so userspace learns of the drop) and return -ENOMEM so the caller learns of the kernel-side memory pressure. This is intentionally distinct from the queue-overflow path, which also queues the lost_events_header but returns 0: a full queue is an expected userspace-pacing condition rather than a kernel error. A subsequent change will cap the upper bound of the veventq_depth.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-07-25
Last Modified
2026-07-25
Generated
2026-07-25
AI Q&A
2026-07-25
EPSS Evaluated
N/A
NVD
CVE-2026-64292
EUVD
EUVD-2026-49004

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
linux linux_kernel *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in the Linux kernel involves a memory allocation issue in the iommufd subsystem. The veventq memory allocation occurs inside a spinlock, which can be exploited by userspace to allocate large queues and exhaust atomic memory reserves. The fix moves the allocation outside the spinlock and uses GFP_NOWAIT to fail fast under memory pressure without using GFP_ATOMIC reserves or direct-reclaiming from threaded IRQ handlers.

Detection Guidance

This vulnerability is specific to the Linux kernel's iommufd subsystem and involves memory exhaustion via veventq allocation. Detection requires checking kernel logs for memory pressure events or allocation failures in iommufd. Commands like dmesg | grep iommufd or journalctl -k | grep -i iommufd may reveal related errors. Monitoring atomic memory reserves with grep MemAvailable /proc/meminfo can also indicate pressure.

Impact Analysis

An attacker with access to userspace could exploit this to cause a denial-of-service by exhausting kernel memory reserves, leading to system instability or crashes. Systems relying on iommufd for I/O virtualization may experience performance degradation or failures under memory pressure.

Mitigation Strategies

Update the Linux kernel to a patched version where this issue is resolved. If immediate patching is not possible, restrict untrusted userspace access to iommufd or disable the subsystem if unused. Monitor system memory usage and kernel logs for signs of atomic memory exhaustion.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-64292. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart