CVE-2026-64289

A flaw was found in the Linux kernel. In the iommufd component, the iommufd_hwpt_invalidate() function allows a local user to provide excessively large values for entry_num and entry_len during cache invalidation. This can lead to a Denial of Service (DoS) by causing the system to become unresponsive. Specifically, large entry_len values can trigger a soft-lockup watchdog due to extensive memory scanning, while large entry_num values can cause an uninterruptible loop, pinning the CPU.

This vulnerability is rated as Moderate severity because it requires local access to the iommufd interface and results strictly in a denial of service without compromising confidentiality or data integrity. An authenticated local user with access to /dev/iommu can submit unbounded cache invalidation requests, stalling CPU execution through excessive zero-checking scans or unrescheduled processing loops. While this can induce kernel soft lockups and render the host unresponsive, it cannot be exploited remotely and does not enable privilege escalation. Standard deployments of earlier Red Hat Enterprise Linux releases lack the affected iommufd functionality and remain unaffected.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.