The Linux kernel's iommufd_veventq_fops_read() function incorrectly uses sizeof(hdr) where hdr is a pointer to struct iommufd_vevent_header, causing the bound check to use the size of the pointer rather than the size of the structure. On 32-bit systems, this results in an under-count of the header size by 4 bytes, allowing a vEVENT with certain data lengths to pass the check improperly and potentially write beyond the user buffer during copy_to_user. On 64-bit systems, the sizes match by coincidence, but the code is fragile and could break if the structure size changes. The fix is to use sizeof(*hdr) consistently to ensure the correct size is checked and copied.

This vulnerability can lead to a buffer overflow in user space on 32-bit systems or future 64-bit systems if the structure size grows beyond pointer size. The CVSS score of 7.8 indicates high impact on confidentiality, integrity, and availability, meaning an attacker with local privileges could exploit this to cause memory corruption, potentially leading to privilege escalation or denial of service.

A fix is available that corrects the sizeof usage in the iommufd_veventq_fops_read() function. Users should apply the official Linux kernel patches that address CVE-2026-64293. Since this is a kernel vulnerability, updating to a patched kernel version is the recommended remediation. No alternative mitigations are specified.