CVE-2026-64291None▾ Sunlit

iommufd: Set veventq_depth upper bound

In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with an upper bound at U32_MAX. This leaves a vulnerabilit…

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Jul 25, 2026

Updated

Nov 6, 2026

CVSS

—

Vendor

Linux

Product

Linux

CWE

—

Depth score

3 · Minimal

EPSS

0.16% · p5

Platforms

—

Source

CVEORG

Vector

—

CISA SSVC

decided 2026-11-06

Exploitation: none
Automatable: no
Technical impact: partial

Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake.

EPSS history

Exploit-prediction probability, daily snapshots since Nov 6.

0.2% → 0.2%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

3 events · 104 days

Jul 25, 2026Published
Disclosed via CVEORG
Nov 6, 2026Record revised
Last analysed / modified upstream
Nov 6, 2026EPSS first tracked
0.2%

Linux #cve.org

Affected

Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < f565297edf316016be4a1a9e2eb9f39359313f43
Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < e7b5e55652746b1221b9c10ff80eae8a154101ba
Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < 6ebf2eb46fbd5b40393ff8fbb847ba96925beaff
Linux 6.15

Full technical detail▾

Overview

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Set veventq_depth upper bound

iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with an upper bound at U32_MAX.

This leaves a vulnerability where userspace can allocate excessively large queues to exhaust kernel memory reserves.

Cap the veventq_depth (maximum number of entries) to 1 << 19, matching the maximum number of entries in the SMMUv3 EVTQ (the largest use case today).

Affected

Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < f565297edf316016be4a1a9e2eb9f39359313f43
Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < e7b5e55652746b1221b9c10ff80eae8a154101ba
Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < 6ebf2eb46fbd5b40393ff8fbb847ba96925beaff
Linux 6.15

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#cve.org

iommufd: Set veventq_depth upper bound

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0 · exploitation 0

Overview

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Set veventq_depth upper bound

iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with an upper bound at U32_MAX.

This leaves a vulnerability where userspace can allocate excessively large queues to exhaust kernel memory reserves.

Cap the veventq_depth (maximum number of entries) to 1 << 19, matching the maximum number of entries in the SMMUv3 EVTQ (the largest use case today).