CVE-2026-64289

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The iommufd hwpt invalidate() function fails to properly validate user-controlled entry num and entry len variables, which are only bounded by U32 MAX. A multi-gigabyte entry len can force the copy helper to scan excess bytes in one uninterruptible pass, triggering the soft-lockup watchdog. Additionally, a large entry num can drive the backend invalidation loop without rescheduling, pinning the CPU on a non-preemptible kernel, specifically within the VT-d nested handler which copies entries and flushes caches per iteration.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.