Linux kernel (drivers/iommu/iommufd): A failed copy_to_user while draining the iommufd fault queue restarts the same

CVSS 6.2CVE-2026-64290Kernel, userspace & hypervisorcurated

Impact

A failed copy_to_user while draining the iommufd fault queue restarts the same failing copy forever, spinning in the kernel at 100% CPU while holding the fault mutex. The task is not killable, the core is gone until reboot, and the I/O page-fault path for that device is wedged - repeat it once per core and the node is finished.

Who can reach it

A tenant container holding /dev/iommu reads the fault fd into a deliberately bad buffer (unmapped or read-only memory). One read syscall, no host privilege, no hardware prerequisite beyond an IOPF-capable device being attached. Trivially repeatable and deterministic - this is the cheapest node-kill in the shard.

What to do

Update to a stable kernel carrying commits a38e0714 / 5539da12. Interim: do not hand /dev/iommu to tenant containers; run passthrough through a VMM the operator controls so the fault fd is never in tenant hands.

References

https://git.kernel.org/stable/c/a38e0714affc5c0bbb40cba5a65d6d32a5e72a71 https://git.kernel.org/stable/c/5539da127d03c1f6c2e2a49fdfbe331a0ccbdea8 https://nvd.nist.gov/vuln/detail/CVE-2026-64290

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.