---
id: CVE-2026-64291
title: 'iommufd: Set veventq_depth upper bound'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommufd: Set veventq_depth upper bound

  iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with
  an upper bound at U32_MAX.

  This leaves a vulnerabilit…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b <
    f565297edf316016be4a1a9e2eb9f39359313f43
  - >-
    Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b <
    e7b5e55652746b1221b9c10ff80eae8a154101ba
  - >-
    Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b <
    6ebf2eb46fbd5b40393ff8fbb847ba96925beaff
  - Linux 6.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:34:03.370926Z'
published: '2026-07-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:32.911Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64291'
references:
  - url: 'https://git.kernel.org/stable/c/f565297edf316016be4a1a9e2eb9f39359313f43'
  - url: 'https://git.kernel.org/stable/c/e7b5e55652746b1221b9c10ff80eae8a154101ba'
  - url: 'https://git.kernel.org/stable/c/6ebf2eb46fbd5b40393ff8fbb847ba96925beaff'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.05206
ingestedAt: '2026-11-06T16:57:43.209Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Set veventq_depth upper bound

iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with
an upper bound at U32_MAX.

This leaves a vulnerability where userspace can allocate excessively large
queues to exhaust kernel memory reserves.

Cap the veventq_depth (maximum number of entries) to 1 << 19, matching the
maximum number of entries in the SMMUv3 EVTQ (the largest use case today).

## Affected

- `Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < f565297edf316016be4a1a9e2eb9f39359313f43`
- `Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < e7b5e55652746b1221b9c10ff80eae8a154101ba`
- `Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < 6ebf2eb46fbd5b40393ff8fbb847ba96925beaff`
- `Linux 6.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.