CVE-2026-64186

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs<br /> <br /> In iommu_mmio_write() and iommu_capability_write(), the variables<br /> dbg_mmio_offset and dbg_cap_offset are declared as int. However, they<br /> are populated using kstrtou32_from_user(). If a user provides a<br /> sufficiently large value, it can become a negative integer.<br /> <br /> Prior to this patch, the AMD IOMMU debugfs implementation was already<br /> protected by different mechanisms.<br /> <br /> 1. #define OFS_IN_SZ 8 ensures the user string OFS_IN_SZ)<br /> return -EINVAL;<br /> <br /> 2. Implicit type promotion in iommu_mmio_write(), dbg_mmio_offset is int<br /> and iommu-&gt;mmio_phys_end is u64<br /> <br /> if (dbg_mmio_offset &gt; iommu-&gt;mmio_phys_end - sizeof(u64))<br /> return -EINVAL;<br /> <br /> 3. The show handlers would currently catch the negative number and<br /> refuse to perform the read.<br /> <br /> Replace kstrtou32_from_user() with kstrtos32_from_user() to parse the<br /> input, and check for negative values to explicitly prevent out-of-bounds<br /> memory accesses directly in iommu_mmio_write() and<br /> iommu_capability_write().