CVE-2026-64293

A flaw was found in the Linux kernel's iommufd component. This vulnerability arises from an incorrect size calculation during a bound-check in the iommufd_veventq_fops_read() function. On 32-bit systems, this error can lead to an out-of-bounds write, allowing data to be copied past the intended user-supplied buffer. This memory corruption could potentially be exploited by a local attacker to cause a denial of service or escalate privileges.

This vulnerability is rated Moderate impact for Red Hat products because triggering the boundary calculation error requires local user access with permissions to interact with the iommufd subsystem, limiting the attack surface. Furthermore, on 64-bit architectures standard across enterprise deployments, the pointer size matches the structure header size, preventing the user buffer overrun. Consequently, the risk of out-of-bounds writes is primarily restricted to 32-bit environments.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.