CVE-2026-64293

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description An issue exists in the iommufd veventq fops read() function where a bound-check for the normal vEVENT path incorrectly uses sizeof(hdr) instead of sizeof(*hdr). Because hdr is a pointer, sizeof(hdr) evaluates to the size of the pointer rather than the size of the struct iommufd vevent header structure. On 32-bit systems, this results in an under-count of the header size by 4 bytes. This discrepancy allows a vEVENT with a specific data len to pass the check and subsequently cause copy to user() to write past the user-supplied buffer. This also represents a latent bug for 64-bit systems should the struct iommufd vevent header be expanded beyond the size of a pointer.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.