powerpc/iommu: TCE IOBA range check ignores npages, allowing out-of-range table access

UnscoredCVE-2026-98282Kernel, userspace & hypervisorcurated

Impact

iommu_tce_check_ioba(), the unified IOBA validator for both KVM and VFIO on powerpc, hardcodes a page count of 1 and ignores the caller's npages. H_STUFF_TCE and H_PUT_TCE_INDIRECT legitimately pass npages > 1, so a guest or a VFIO user can submit a range that starts in bounds and runs past the end of the TCE table, with no overflow check on the arithmetic. That is a guest-controlled out-of-bounds access against host IOMMU translation state - the boundary that is supposed to keep a device-assigned VM from reaching other memory. Relevant only to POWER hosts doing KVM or VFIO device passthrough; x86 and arm64 accelerator nodes are unaffected.

Who can reach it

A KVM guest issuing TCE hypercalls, or a local user with VFIO access to a passed-through device, on a powerpc host. Authenticated access to the guest or the VFIO device is required.

What to do

Apply the stable fix that accounts for npages, checks for arithmetic overflow and validates the full requested range against the table size. Kernel update plus host reboot, so drain guests and GPU work from the node. No CVSS score or vendor advisory in the record.

References

https://nvd.nist.gov/vuln/detail/CVE-2026-98282 https://git.kernel.org/stable/c/0543813753ef5cfbd6fa96694f7acf783fa01af7 https://git.kernel.org/stable/c/314091243159f8e3749bc719bb129f423f72fd86

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.