CVE-2026-64291: Linux kernel · iommufd: Set veventq_depth upper bound
Affects Linux kernelSource CVE Database V5
Not known to be exploited · fixed in f565297edf316016be4a1a9e2eb9f39359313f43 : patch Linux kernel soon.
Data as of 6 Nov 2026, 16:51 UTC
Rated High by Threat Radar's AI analysis · No CVSS score from NVD or the CNA
Thin evidence
One scorer or none- CISA SSVC
- Exploitation
- No evidence of active exploitation and no public proof of concept
- Automatable
- Attackers cannot reliably automate steps 1–4 of the kill chain
- Technical impact
- Limited control over the software or limited information exposure
CISA SSVC assessment, 2026-11-06.
- Patch
- Available – fixed in f565297edf316016be4a1a9e2eb9f39359313f43, e7b5e55652746b1221b9c10ff80eae8a154101ba, 6ebf2eb46fbd5b40393ff8fbb847ba96925beaff
Exploitation evidence
Disclosed: evidence found.
CVE published 25 Jul 2026
Detectable: no evidence on record.
No public nuclei template indexed
Weaponized: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 6 Nov 2026.
What to do
Upgrade Linux kernel to f565297edf316016be4a1a9e2eb9f39359313f43, e7b5e55652746b1221b9c10ff80eae8a154101ba or 6ebf2eb46fbd5b40393ff8fbb847ba96925beaff.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in
|
| LinuxLinux | Affected
| Fixed in– |
AI-suggested
A fix is available and has been applied in the Linux kernel as indicated by the fixed commit versions. Users should update to the fixed kernel versions to mitigate this vulnerability.
Description
A vulnerability in the Linux kernel's iommufd component allowed userspace to specify an excessively large veventq_depth value, potentially exhausting kernel memory reserves. The flaw was due to the lack of an upper bound on veventq_depth, which was previously capped only by U32_MAX. The issue has been fixed by capping veventq_depth to 1 << 19, aligning with the maximum entries in the SMMUv3 EVTQ.