Linux hwe edge: In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In… (CVE-2026-64186)

The vulnerability CVE-2026-64186 in the Linux kernel concerns the AMD IOMMU debugfs interface where variables dbg_mmio_offset and dbg_cap_offset were declared as int but populated using kstrtou32_from_user(), which converts user input to unsigned 32-bit integers. If a user provides a large value, it could be interpreted as a negative integer due to signedness issues, leading to latent out-of-bounds memory access. The kernel had some protections limiting input size and checking bounds, but the root cause was the incorrect parsing function. The fix replaced kstrtou32_from_user() with kstrtos32_from_user() to correctly parse signed integers, eliminating the out-of-bounds access risk. This vulnerability affects many Linux kernel versions prior to 7.0.0-28.28.1 and specific listed versions. The patch is available and included in updated Linux kernel releases.

The vulnerability could allow a local attacker to cause out-of-bounds memory access in the AMD IOMMU debugfs interface, potentially leading to denial of service or other unintended behavior. The CVSS score is 7.1 (medium severity) with impact primarily on confidentiality (high) and availability (high), but no integrity impact. No known exploits in the wild have been reported. The issue requires local access and low privileges to exploit.

A patch is available and should be applied by updating the Linux kernel to the fixed versions at or beyond 7.0.0-28.28.1 or the specific patched versions listed in the advisory. After updating, a system reboot is required to apply the fixes. Due to ABI changes, third-party kernel modules must be recompiled and reinstalled. Follow the vendor's update instructions carefully. No additional mitigation actions are indicated by the vendor advisory.