CVE-2026-64186 - Fixing Latent Out-of-Bounds Access in IOMMU Debugfs

CVE-2026-64186 - Fixing Latent Out-of-Bounds Access in IOMMU Debugfs

In the Linux kernel, a significant vulnerability has been resolved: CVE-2026-64186. This issue pertains to a latent out-of-bounds access in the IOMMU debugfs.

In the functions iommu_mmio_write() and iommu_capability_write(), the variables dbg_mmio_offset and dbg_cap_offset were declared as int. However, they were populated using kstrtou32_from_user(). If a user provided a sufficiently large value, it could lead to a negative integer, causing potential security risks. 🚨

Prior to this patch, the AMD IOMMU debugfs implementation had several protective mechanisms in place. One such mechanism, #define OFS_IN_SZ 8, ensured that the user string was limited to <= 8 bytes. For instance, 0xffffffff would not be a valid input if cnt > OFS_IN_SZ returned -EINVAL. Additionally, implicit type promotion in iommu_mmio_write() checked if dbg_mmio_offset was greater than iommu->mmio_phys_end - sizeof(u64), returning -EINVAL if it was. The show handlers would also catch negative numbers and refuse to perform the read operation.

The resolution for CVE-2026-64186 involves replacing kstrtou32_from_user() with kstrtos32_from_user() to properly parse the input and explicitly check for negative values. This change directly prevents out-of-bounds memory accesses in both iommu_mmio_write() and iommu_capability_write(). 🔧

This vulnerability affects the Linux kernel, specifically the drivers/iommu/amd/debugfs.c file. Affected versions include Linux kernel version 6.17, with other affected versions associated with specific git commits. Unaffected versions include those prior to 6.17, kernel version 6.18.34, 7.0.11, and 7.1.

For more details, you can read the complete article here: Read full article