CVE-2026-98282

A flaw was found in the Linux kernel's PowerPC Input-Output Memory Management Unit (IOMMU) subsystem. The memory address validation logic fails to account for multi-page requests, leading to an arithmetic overflow and improper boundary verification. A local user or guest virtual machine can exploit this flaw by submitting crafted I/O requests that exceed allocated boundaries, potentially resulting in memory corruption or a denial of service (DoS) via a system crash.

This vulnerability is rated as having Moderate impact because it is restricted to PowerPC hardware running KVM virtualization or VFIO guest configurations, requiring local or authenticated guest access to invoke the affected hypercalls. Workloads deployed on other hardware architectures, such as x86_64, aarch64, or s390x, do not implement this PowerPC-specific IOMMU subsystem and are unaffected. On vulnerable systems, triggering the boundary validation flaw requires passing multi-page requests through specific hypercalls, limiting the blast radius to environments managing PowerPC virtualized guests.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.