The Linux kernel's iommufd_veventq_fops_read() function incorrectly uses sizeof(hdr) (pointer size) instead of sizeof(*hdr) (structure size) for bound checking the vEVENT header. On 32-bit systems, this causes the check to undercount the header size by 4 bytes, allowing a copy operation to write beyond the user buffer, leading to a potential buffer overflow. On 64-bit systems, the issue currently does not manifest due to pointer and structure sizes matching, but remains a latent bug if the structure grows. The fix replaces sizeof(hdr) with sizeof(*hdr) to ensure correct bounds checking.

On 32-bit architectures, this vulnerability can cause a buffer overflow in the kernel when reading vEVENT data, potentially leading to memory corruption or kernel instability. The issue does not currently affect 64-bit systems but could become problematic if the structure size increases. No known exploits are reported in the wild.

A fix is available that corrects the size check to use sizeof(*hdr) instead of sizeof(hdr). Users and maintainers should apply the official Linux kernel patch that addresses this issue. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. No alternative mitigations are specified.