CVE-2026-64291 PUBLISHED

iommufd: Set veventq_depth upper bound

Assigner: Linux
Reserved: 19.07.2026 Published: 25.07.2026 Updated: 25.07.2026

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Set veventq_depth upper bound

iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with an upper bound at U32_MAX.

This leaves a vulnerability where userspace can allocate excessively large queues to exhaust kernel memory reserves.

Cap the veventq_depth (maximum number of entries) to 1 << 19, matching the maximum number of entries in the SMMUv3 EVTQ (the largest use case today).

Product Status

Vendor Linux
Product Linux
Versions Default: unaffected
  • affected from e36ba5ab808ef6237c3148d469c8238674230e2b to f565297edf316016be4a1a9e2eb9f39359313f43 (excl.)
  • affected from e36ba5ab808ef6237c3148d469c8238674230e2b to e7b5e55652746b1221b9c10ff80eae8a154101ba (excl.)
  • affected from e36ba5ab808ef6237c3148d469c8238674230e2b to 6ebf2eb46fbd5b40393ff8fbb847ba96925beaff (excl.)
Vendor Linux
Product Linux
Versions Default: affected
  • Version 6.15 is affected
  • unaffected from 0 to 6.15 (excl.)
  • unaffected from 6.18.39 to 6.18.* (incl.)
  • unaffected from 7.1.4 to 7.1.* (incl.)
  • unaffected from 7.2-rc1 to * (incl.)

References