---
id: CVE-2026-64292
title: 'iommufd: Move vevent memory allocation outside spinlock'
summary: |-
  In the Linux kernel, the following vulnerability has been resolved:

  iommufd: Move vevent memory allocation outside spinlock

  The veventq memory allocation happens inside the spinlock. Given its depth
  is decided by the user space, this l…
severity: none
vendor: Linux
product: Linux
affected:
  - >-
    Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b <
    779480ea79551c31964e74b9aef0e730faa3aa11
  - >-
    Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b <
    6c5fc40200cd0a87d66a368eee00df4d1cca946e
  - >-
    Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b <
    47443565d10c51366c9382dbc8597cd6c460b8a2
  - Linux 6.15
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-06T16:34:08.156179Z'
published: '2026-07-25'
updated: '2026-11-06'
sourceUpdated: '2026-11-06T16:34:33.062Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-64292'
references:
  - url: 'https://git.kernel.org/stable/c/779480ea79551c31964e74b9aef0e730faa3aa11'
  - url: 'https://git.kernel.org/stable/c/6c5fc40200cd0a87d66a368eee00df4d1cca946e'
  - url: 'https://git.kernel.org/stable/c/47443565d10c51366c9382dbc8597cd6c460b8a2'
tags:
  - cve.org
epss: 0.0016
epssPercentile: 0.05201
ingestedAt: '2026-11-06T16:57:43.208Z'
---

## Overview

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Move vevent memory allocation outside spinlock

The veventq memory allocation happens inside the spinlock. Given its depth
is decided by the user space, this leaves a vulnerability, where userspace
can allocate large queues to exhaust atomic memory reserves.

Move the allocation outside the spinlock and use GFP_NOWAIT, which can fail
fast under memory pressure without dipping into the GFP_ATOMIC reserves or
direct-reclaiming from the threaded IRQ handler. On allocation failure,
queue the lost_events_header (so userspace learns of the drop) and return
-ENOMEM so the caller learns of the kernel-side memory pressure.

This is intentionally distinct from the queue-overflow path, which also
queues the lost_events_header but returns 0: a full queue is an expected
userspace-pacing condition rather than a kernel error.

A subsequent change will cap the upper bound of the veventq_depth.

## Affected

- `Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < 779480ea79551c31964e74b9aef0e730faa3aa11`
- `Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < 6c5fc40200cd0a87d66a368eee00df4d1cca946e`
- `Linux >= e36ba5ab808ef6237c3148d469c8238674230e2b < 47443565d10c51366c9382dbc8597cd6c460b8a2`
- `Linux 6.15`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.