Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entry_num and entry_len… (CVE-2026-64289)
In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entry_num and entry_len iommufd_hwpt_invalidate() takes a user-controlled entry_num and entry_len, each bounded only by U32_MAX. An entry_len beyond the kernel's struct size makes the copy helper verify the extra bytes are zero, scanning that excess in one uninterruptible pass; a multi-gigabyte value over zeroed user memory trips the soft-lockup watchdog. A large entry_num is the other half, driving the backend invalidation loop with no reschedule. The VT-d nested handler, for one, copies each entry and flushes caches per iteration, pinning the CPU on a non-preemptible kernel. Cap both in the ioctl. entry_len is held under PAGE_SIZE, above any request struct, and entry_num under 1 << 19, the order of a hardware invalidation queue and well beyond any real batch, bounding the per-call loop length.
AI Analysis
Technical Summary
The Linux kernel's iommufd_hwpt_invalidate() function previously accepted user-controlled values for entry_num and entry_len, each only bounded by U32_MAX. Excessively large entry_len values caused the kernel to scan large zeroed memory regions in an uninterruptible pass, triggering the soft-lockup watchdog. Similarly, large entry_num values drove a backend invalidation loop without rescheduling, causing CPU pinning. The fix caps entry_len under PAGE_SIZE and entry_num under 1 << 19, limiting the per-call loop length and preventing CPU soft-lockups.
Potential Impact
Exploitation of this vulnerability could cause the kernel to become unresponsive due to soft-lockups caused by prolonged uninterruptible operations in cache invalidation. This results in denial of service conditions by pinning the CPU and preventing normal kernel scheduling.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to impose upper bounds on entry_num and entry_len parameters in the iommufd cache invalidation ioctl. Users should update to a kernel version that includes this fix. Patch status is not explicitly confirmed in the provided data; users should consult the vendor advisory for current remediation guidance.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entry_num and entry_len… (CVE-2026-64289)
Description
In the Linux kernel, the following vulnerability has been resolved: iommufd: Set upper bounds on cache invalidation entry_num and entry_len iommufd_hwpt_invalidate() takes a user-controlled entry_num and entry_len, each bounded only by U32_MAX. An entry_len beyond the kernel's struct size makes the copy helper verify the extra bytes are zero, scanning that excess in one uninterruptible pass; a multi-gigabyte value over zeroed user memory trips the soft-lockup watchdog. A large entry_num is the other half, driving the backend invalidation loop with no reschedule. The VT-d nested handler, for one, copies each entry and flushes caches per iteration, pinning the CPU on a non-preemptible kernel. Cap both in the ioctl. entry_len is held under PAGE_SIZE, above any request struct, and entry_num under 1 << 19, the order of a hardware invalidation queue and well beyond any real batch, bounding the per-call loop length.
CVSS v3.1
Score 5.5medium
Affected software
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's iommufd_hwpt_invalidate() function previously accepted user-controlled values for entry_num and entry_len, each only bounded by U32_MAX. Excessively large entry_len values caused the kernel to scan large zeroed memory regions in an uninterruptible pass, triggering the soft-lockup watchdog. Similarly, large entry_num values drove a backend invalidation loop without rescheduling, causing CPU pinning. The fix caps entry_len under PAGE_SIZE and entry_num under 1 << 19, limiting the per-call loop length and preventing CPU soft-lockups.
Potential Impact
Exploitation of this vulnerability could cause the kernel to become unresponsive due to soft-lockups caused by prolonged uninterruptible operations in cache invalidation. This results in denial of service conditions by pinning the CPU and preventing normal kernel scheduling.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to impose upper bounds on entry_num and entry_len parameters in the iommufd cache invalidation ioctl. Users should update to a kernel version that includes this fix. Patch status is not explicitly confirmed in the provided data; users should consult the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-m7qh-p3gf-gcv8
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64289"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420e9c2644c7f808631b
Added to database: 07/25/2026, 23:09:02 UTC
Last enriched: 08/15/2026, 03:14:29 UTC
Last updated: 09/07/2026, 22:52:14 UTC
Views: 46
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.