Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0… (CVE-2026-64291)
A vulnerability in the Linux kernel's iommufd component allowed userspace to specify an excessively large veventq_depth value, potentially exhausting kernel memory reserves. The issue arises because iommufd_veventq_alloc() accepted any non-zero veventq_depth up to U32_MAX without an upper bound. The fix caps veventq_depth to 1 << 19, aligning with the maximum entries in the SMMUv3 EVTQ.
AI Analysis
Technical Summary
The Linux kernel's iommufd_veventq_alloc() function previously accepted any non-zero veventq_depth value from userspace up to U32_MAX, allowing allocation of excessively large event queues. This could lead to exhaustion of kernel memory reserves. The vulnerability is addressed by capping veventq_depth to 1 << 19, which matches the largest expected use case in SMMUv3 EVTQ implementations.
Potential Impact
This vulnerability can cause denial of service by exhausting kernel memory resources due to unbounded allocation of event queues. There is no impact on confidentiality or integrity. The CVSS score is 5.5 (medium severity) reflecting the local attack vector, low complexity, and impact limited to availability.
Mitigation Recommendations
A fix is available that caps the veventq_depth parameter to prevent excessive memory allocation. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel vulnerability, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult their Linux distribution's security advisories for the relevant fixes.
Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: iommufd: Set veventq_depth upper bound iommufd_veventq_alloc() accepts any !0… (CVE-2026-64291)
Description
A vulnerability in the Linux kernel's iommufd component allowed userspace to specify an excessively large veventq_depth value, potentially exhausting kernel memory reserves. The issue arises because iommufd_veventq_alloc() accepted any non-zero veventq_depth up to U32_MAX without an upper bound. The fix caps veventq_depth to 1 << 19, aligning with the maximum entries in the SMMUv3 EVTQ.
CVSS v3.1
Score 5.5medium
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Linux kernel's iommufd_veventq_alloc() function previously accepted any non-zero veventq_depth value from userspace up to U32_MAX, allowing allocation of excessively large event queues. This could lead to exhaustion of kernel memory reserves. The vulnerability is addressed by capping veventq_depth to 1 << 19, which matches the largest expected use case in SMMUv3 EVTQ implementations.
Potential Impact
This vulnerability can cause denial of service by exhausting kernel memory resources due to unbounded allocation of event queues. There is no impact on confidentiality or integrity. The CVSS score is 5.5 (medium severity) reflecting the local attack vector, low complexity, and impact limited to availability.
Mitigation Recommendations
A fix is available that caps the veventq_depth parameter to prevent excessive memory allocation. Users should apply the official Linux kernel updates that include this patch. Since this is a kernel vulnerability, upgrading to a patched kernel version is the recommended remediation. Patch status is not explicitly confirmed in the provided data; users should consult their Linux distribution's security advisories for the relevant fixes.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-6gx3-fvx8-mx4p
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-64291"]
- Ecosystems
- []
- Database Specific Severity
- null
- Cvss Version
- null
Threat ID: 6a65420e9c2644c7f80865e0
Added to database: 07/25/2026, 23:09:02 UTC
Last enriched: 08/15/2026, 03:14:16 UTC
Last updated: 09/07/2026, 10:52:10 UTC
Views: 36
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.