{"id":"CVE-2026-64291","title":"iommufd: Set veventq_depth upper bound","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Set veventq_depth upper bound\n\niommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with\nan upper bound at U32_MAX.\n\nThis leaves a vulnerabilit…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < f565297edf316016be4a1a9e2eb9f39359313f43","Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < e7b5e55652746b1221b9c10ff80eae8a154101ba","Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < 6ebf2eb46fbd5b40393ff8fbb847ba96925beaff","Linux 6.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:34:03.370926Z"},"published":"2026-07-25","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:34:32.911Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64291","references":[{"url":"https://git.kernel.org/stable/c/f565297edf316016be4a1a9e2eb9f39359313f43"},{"url":"https://git.kernel.org/stable/c/e7b5e55652746b1221b9c10ff80eae8a154101ba"},{"url":"https://git.kernel.org/stable/c/6ebf2eb46fbd5b40393ff8fbb847ba96925beaff"}],"tags":["cve.org"],"epss":0.0016,"epssPercentile":0.05206,"ingestedAt":"2026-11-06T16:57:43.209Z","slug":"CVE-2026-64291","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Set veventq_depth upper bound\n\niommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with\nan upper bound at U32_MAX.\n\nThis leaves a vulnerability where userspace can allocate excessively large\nqueues to exhaust kernel memory reserves.\n\nCap the veventq_depth (maximum number of entries) to 1 << 19, matching the\nmaximum number of entries in the SMMUv3 EVTQ (the largest use case today).\n\n## Affected\n\n- `Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < f565297edf316016be4a1a9e2eb9f39359313f43`\n- `Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < e7b5e55652746b1221b9c10ff80eae8a154101ba`\n- `Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < 6ebf2eb46fbd5b40393ff8fbb847ba96925beaff`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}