{"id":"CVE-2026-64292","title":"iommufd: Move vevent memory allocation outside spinlock","summary":"In the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Move vevent memory allocation outside spinlock\n\nThe veventq memory allocation happens inside the spinlock. Given its depth\nis decided by the user space, this l…","severity":"none","vendor":"Linux","product":"Linux","affected":["Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < 779480ea79551c31964e74b9aef0e730faa3aa11","Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < 6c5fc40200cd0a87d66a368eee00df4d1cca946e","Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < 47443565d10c51366c9382dbc8597cd6c460b8a2","Linux 6.15"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-06T16:34:08.156179Z"},"published":"2026-07-25","updated":"2026-11-06","sourceUpdated":"2026-11-06T16:34:33.062Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-64292","references":[{"url":"https://git.kernel.org/stable/c/779480ea79551c31964e74b9aef0e730faa3aa11"},{"url":"https://git.kernel.org/stable/c/6c5fc40200cd0a87d66a368eee00df4d1cca946e"},{"url":"https://git.kernel.org/stable/c/47443565d10c51366c9382dbc8597cd6c460b8a2"}],"tags":["cve.org"],"epss":0.0016,"epssPercentile":0.05201,"ingestedAt":"2026-11-06T16:57:43.208Z","slug":"CVE-2026-64292","body":"## Overview\n\nIn the Linux kernel, the following vulnerability has been resolved:\n\niommufd: Move vevent memory allocation outside spinlock\n\nThe veventq memory allocation happens inside the spinlock. Given its depth\nis decided by the user space, this leaves a vulnerability, where userspace\ncan allocate large queues to exhaust atomic memory reserves.\n\nMove the allocation outside the spinlock and use GFP_NOWAIT, which can fail\nfast under memory pressure without dipping into the GFP_ATOMIC reserves or\ndirect-reclaiming from the threaded IRQ handler. On allocation failure,\nqueue the lost_events_header (so userspace learns of the drop) and return\n-ENOMEM so the caller learns of the kernel-side memory pressure.\n\nThis is intentionally distinct from the queue-overflow path, which also\nqueues the lost_events_header but returns 0: a full queue is an expected\nuserspace-pacing condition rather than a kernel error.\n\nA subsequent change will cap the upper bound of the veventq_depth.\n\n## Affected\n\n- `Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < 779480ea79551c31964e74b9aef0e730faa3aa11`\n- `Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < 6c5fc40200cd0a87d66a368eee00df4d1cca946e`\n- `Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < 47443565d10c51366c9382dbc8597cd6c460b8a2`\n- `Linux 6.15`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":3,"depthScoreParts":{"impact":2.8,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}