In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0… (CVE-2026-64291)
A vulnerability in the Linux kernel's iommufd component allowed userspace to specify an excessively large veventq_depth value when allocating event queues, potentially exhausting kernel memory reserves. The issue was due to the lack of an appropriate upper bound on veventq_depth, which was previously capped only by U32_MAX. The fix caps veventq_depth to 1 << 19, aligning with the maximum entries in the SMMUv3 EVTQ, mitigating the risk of memory exhaustion.
AI Analysis
Technical Summary
The Linux kernel's iommufd_veventq_alloc() function accepted any non-zero veventq_depth value from userspace with an upper bound of U32_MAX. This allowed userspace to allocate excessively large event queues, potentially exhausting kernel memory reserves. The vulnerability was addressed by capping veventq_depth to 1 << 19, matching the largest expected use case in SMMUv3 EVTQ, thereby preventing excessive memory allocation.
Potential Impact
Userspace processes could exploit this vulnerability to allocate excessively large kernel memory queues, leading to potential exhaustion of kernel memory reserves. This could degrade system stability or cause denial of service conditions due to resource exhaustion.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to cap veventq_depth to 1 << 19 in iommufd_veventq_alloc(). Users should update to a kernel version that includes this fix once available. Patch status is not yet confirmed from vendor advisory; users should monitor official Linux kernel advisories for the specific patch release.
In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0… (CVE-2026-64291)
Description
A vulnerability in the Linux kernel's iommufd component allowed userspace to specify an excessively large veventq_depth value when allocating event queues, potentially exhausting kernel memory reserves. The issue was due to the lack of an appropriate upper bound on veventq_depth, which was previously capped only by U32_MAX. The fix caps veventq_depth to 1 << 19, aligning with the maximum entries in the SMMUv3 EVTQ, mitigating the risk of memory exhaustion.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's iommufd_veventq_alloc() function accepted any non-zero veventq_depth value from userspace with an upper bound of U32_MAX. This allowed userspace to allocate excessively large event queues, potentially exhausting kernel memory reserves. The vulnerability was addressed by capping veventq_depth to 1 << 19, matching the largest expected use case in SMMUv3 EVTQ, thereby preventing excessive memory allocation.
Potential Impact
Userspace processes could exploit this vulnerability to allocate excessively large kernel memory queues, leading to potential exhaustion of kernel memory reserves. This could degrade system stability or cause denial of service conditions due to resource exhaustion.
Mitigation Recommendations
A fix has been implemented in the Linux kernel to cap veventq_depth to 1 << 19 in iommufd_veventq_alloc(). Users should update to a kernel version that includes this fix once available. Patch status is not yet confirmed from vendor advisory; users should monitor official Linux kernel advisories for the specific patch release.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6gx3-fvx8-mx4p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64291"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420e9c2644c7f80865e0
Added to database: 07/25/2026, 23:09:02 UTC
Last enriched: 07/25/2026, 23:40:26 UTC
Last updated: 07/26/2026, 03:45:26 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.