CVE-2026-64289

/// Technical description

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Set upper bounds on cache invalidation entry_num and entry_len

iommufd_hwpt_invalidate() takes a user-controlled entry_num and entry_len,

each bounded only by U32_MAX. An entry_len beyond the kernel's struct size

makes the copy helper verify the extra bytes are zero, scanning that excess

in one uninterruptible pass; a multi-gigabyte value over zeroed user memory

trips the soft-lockup watchdog.

A large entry_num is the other half, driving the backend invalidation loop

with no reschedule. The VT-d nested handler, for one, copies each entry and

flushes caches per iteration, pinning the CPU on a non-preemptible kernel.

Cap both in the ioctl. entry_len is held under PAGE_SIZE, above any request

struct, and entry_num under 1 << 19, the order of a hardware invalidation

queue and well beyond any real batch, bounding the per-call loop length.

/// Remediation

Check the references section for vendor advisories, patches, and mitigation guidance. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

/// References