CVE-2026-64186

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs

In iommu_mmio_write() and iommu_capability_write(), the variables

dbg_mmio_offset and dbg_cap_offset are declared as int. However, they

are populated using kstrtou32_from_user(). If a user provides a

sufficiently large value, it can become a negative integer.

Prior to this patch, the AMD IOMMU debugfs implementation was already

protected by different mechanisms.

1. #define OFS_IN_SZ 8 ensures the user string <= 8 bytes, so

e.g. 0xffffffff isn't a valid input.

if (cnt > OFS_IN_SZ)

return -EINVAL;

2. Implicit type promotion in iommu_mmio_write(), dbg_mmio_offset is int

and iommu->mmio_phys_end is u64

if (dbg_mmio_offset > iommu->mmio_phys_end - sizeof(u64))

return -EINVAL;

3. The show handlers would currently catch the negative number and

refuse to perform the read.

Replace kstrtou32_from_user() with kstrtos32_from_user() to p

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References