CVE-2026-98282 powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
An integer overflow in the Linux kernel's PowerPC IOMMU code allows attackers to bypass bounds checks, potentially leading to privilege escalation or code execution.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-98282?
CVE-2026-98282 is a high-severity vulnerability in Linux, published on 6 Oct 2026. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
powerpc/iommu: Fix the overflow validation in iommu_tce_check_ioba
The commit b1af23d836f8 ("KVM: PPC: iommu: Unify TCE checking") unified IOBA parameter checking across KVM and VFIO into iommu_tce_check_ioba(). While doing so, the passed in argument npages is ignored and constant value '1' is used leaving out a possible overflow as the callers can legitimately be using npages > 1 for H_STUFF_TCE or H_PUT_TCE_INDIRECT cases.
Fix this by accounting for 'npages', checking for arithmetic overflow, and verifying that the entire requested range (ioba - offset + npages) does not exceed the table capacity 'size'.
Which versions are affected by CVE-2026-98282?
How do I fix CVE-2026-98282?
Apply the vendor's patch.
Is CVE-2026-98282 being exploited?
There is no known exploitation of CVE-2026-98282 in the wild and no public exploit code.
Sources
Also known as AZL-106383, BELL-CVE-2026-98282, DEBIAN-CVE-2026-98282, GHSA-8m3g-gm8v-p3m6, UBUNTU-CVE-2026-98282.