{"id":"CVE-2026-64186","title":"iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Remove latent out-of-bounds access in IOMMU debugfs\n\nIn iommu_mmio_write() and iommu_capability_write(), the variables\ndbg_mmio_offset and dbg_cap_offset are…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= 7a4ee419e8c144b747a8915856e91a034d7c8f34 < 488d2c76bd9f78433a70690d1054bfae3d39a407","Linux >= 7a4ee419e8c144b747a8915856e91a034d7c8f34 < 62f9dfbf1aceae88b03c5ca08f7d36e943939dec","Linux >= 7a4ee419e8c144b747a8915856e91a034d7c8f34 < 8dfd3d8d74435344ee8dc9237596959c8b2a6cbe","Linux 6.17"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:31:49.258462Z"},"published":"2026-07-19","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:34:29.105Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64186","references":[{"url":"https://git.kernel.org/stable/c/488d2c76bd9f78433a70690d1054bfae3d39a407"},{"url":"https://git.kernel.org/stable/c/62f9dfbf1aceae88b03c5ca08f7d36e943939dec"},{"url":"https://git.kernel.org/stable/c/8dfd3d8d74435344ee8dc9237596959c8b2a6cbe"}],"tags":["cve.org"],"epss":0.00164,"epssPercentile":0.05651,"ingestedAt":"2026-11-06T16:57:43.221Z","slug":"CVE-2026-64186","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommu/amd: Remove latent out-of-bounds access in IOMMU debugfs\n\nIn iommu_mmio_write() and iommu_capability_write(), the variables\ndbg_mmio_offset and dbg_cap_offset are declared as int. However, they\nare populated using kstrtou32_from_user(). If a user provides a\nsufficiently large value, it can become a negative integer.\n\nPrior to this patch, the AMD IOMMU debugfs implementation was already\nprotected by different mechanisms.\n\n1. #define OFS_IN_SZ 8 ensures the user string <= 8 bytes, so\n   e.g. 0xffffffff isn't a valid input.\n\n  if (cnt > OFS_IN_SZ)\n     return -EINVAL;\n\n2. Implicit type promotion in iommu_mmio_write(), dbg_mmio_offset is int\n   and iommu->mmio_phys_end is u64\n\n  if (dbg_mmio_offset > iommu->mmio_phys_end - sizeof(u64))\n      return -EINVAL;\n\n3. The show handlers would currently catch the negative number and\n   refuse to perform the read.\n\nReplace kstrtou32_from_user() with kstrtos32_from_user() to parse the\ninput, and check for negative values to explicitly prevent out-of-bounds\nmemory accesses directly in iommu_mmio_write() and\niommu_capability_write().\n\n## Affected\n\n- `Linux >= 7a4ee419e8c144b747a8915856e91a034d7c8f34 < 488d2c76bd9f78433a70690d1054bfae3d39a407`\n- `Linux >= 7a4ee419e8c144b747a8915856e91a034d7c8f34 < 62f9dfbf1aceae88b03c5ca08f7d36e943939dec`\n- `Linux >= 7a4ee419e8c144b747a8915856e91a034d7c8f34 < 8dfd3d8d74435344ee8dc9237596959c8b2a6cbe`\n- `Linux 6.17`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}