CVE-2026-64186 iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
A local attacker with debugfs access could trigger an out-of-bounds read in the AMD IOMMU driver due to improper integer handling, potentially causing information disclosure or system crashes.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-64186?
CVE-2026-64186 is a high-severity vulnerability in Linux kernel, published on 19 Jul 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
In iommu_mmio_write() and iommu_capability_write(), the variables dbg_mmio_offset and dbg_cap_offset are declared as int. However, they are populated using kstrtou32_from_user(). If a user provides a sufficiently large value, it can become a negative integer.
Prior to this patch, the AMD IOMMU debugfs implementation was already protected by different mechanisms.
1. #define OFS_IN_SZ 8 ensures the user string <= 8 bytes, so e.g. 0xffffffff isn't a valid input.
if (cnt > OFS_IN_SZ) return -EINVAL;
2. Implicit type promotion in iommu_mmio_write(), dbg_mmio_offset is int and iommu->mmio_phys_end is u64
if (dbg_mmio_offset > iommu->mmio_phys_end - sizeof(u64)) return -EINVAL;
3. The show handlers would currently catch the negative number and refuse to perform the read.
Replace kstrtou32_from_user() with kstrtos32_from_user() to parse the input, and check for negative values to explicitly prevent out-of-bounds memory accesses directly in iommu_mmio_write() and iommu_capability_write().
Weakness: CWE-125
Which versions are affected by CVE-2026-64186?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2026-64186?
Apply the vendor's patch.
Is CVE-2026-64186 being exploited?
There is no known exploitation of CVE-2026-64186 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as BELL-CVE-2026-64186, DEBIAN-CVE-2026-64186, GHSA-398p-2vfw-ch77, UBUNTU-CVE-2026-64186.