Linux kernel iommufd: pointer-sized bound check in veventq read can write past the user buffer

Impact

The bound check in the vEVENT read path uses sizeof(hdr) - the size of a pointer - where the rest of the function uses sizeof(*hdr). On 64-bit hosts the two happen to be equal today, so GPU-passthrough and SR-IOV hosts on x86-64 and arm64 are not affected in practice; on 32-bit builds the check under-counts the header by four bytes and the copy writes past the caller's buffer. It is also a latent bug the moment struct iommufd_vevent_header grows beyond a pointer width. iommufd is the interface behind VFIO device assignment, so operators passing GPUs or NICs into VMs should patch it, but should not treat this as an urgent 64-bit exposure.

Who can reach it

Local user holding an iommufd vEVENT queue file descriptor, i.e. a process permitted to drive VFIO device assignment. Exploitable only on 32-bit kernels as the structure stands.

What to do

Apply the stable fix using sizeof(*hdr) and reboot the node. On 64-bit hosts this can ride along with the next scheduled kernel maintenance rather than an emergency window.

References

Related entries

• Linux kernel perf AUX buffer: missing aux_mutex in map_range lets a local user map a freed pageCVE-2026-64300 · Linux kernel perf ring buffer AUX area (map_range / rb_alloc_aux locking)High
• Linux kernel QAT crypto driver: oversized RSA CRT components overflow half-size DMA buffersCVE-2026-64304 · Linux kernel crypto qat driver (RSA CRT key setup, qat_rsa_setkey_crt)High
• Linux kernel Intel QAT: unlocked service_table walks can corrupt the list or use freed entriesCVE-2026-64305 · Linux kernel Intel QAT driver (adf service_table list locking)High
• Linux kernel BPF: LPM trie RCU annotations reject sleepable programs and spam lockdep warningsCVE-2026-64352 · Linux kernel BPF LPM trie (RCU annotations for sleepable programs)High
• Linux BPF: BTF repeated-field count overflow allows an out-of-bounds write on BPF_BTF_LOADCVE-2026-64354 · Linux kernel BPF BTF parser (btf_repeat_fields expansion)High
• Linux mm: shrinker_info teardown races with expansion, giving a double free of memcg shrinker mapsCVE-2026-64418 · Linux kernel memcg shrinker_info (alloc/teardown race with expand_shrinker_info)High