CVE-2026-64186: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs
High 7.1 EPSS 0.2% Linux kernel
In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommu_mmio_write() and iommu_capability_write(), the variables dbg_mmio_offset and dbg_cap_offset are declared as int. However, they are populated using kstrtou32_from_user(). If a user provides a sufficiently large value, it can become a negative integer. Prior to this patch, the AMD IOMMU debugfs implementation was already protected by different mechanisms. 1. #define OFS_IN_SZ 8 ensures the user string <= 8 bytes, so e.g. 0xffffffff isn't a valid input. if (cnt > OFS_IN_SZ) return -EINVAL; 2. Implicit type promotion in iommu_mmio_write(), dbg_mmio_offset is int and iommu->mmio_phys_end is u64 if (dbg_mmio_offset > iommu->mmio_phys_end - sizeof(u64)) return -EINVAL; 3. The show handlers would currently catch the negative number and refuse to perform the read. Replace kstrtou32_from_user() with kstrtos32_from_user() to parse the input, and check for negative values to explicitly prevent out-of-bounds memory accesses directly in iommu_mmio_write() and iommu_capability_write().
- CVE-2026-64186CVE identifier
- 7.1CVSS 3.1 base score (high)
- 0.2%EPSS: chance of exploitation in the next 30 days (higher than 6% of CVEs)
- 2026-07-19published
What do these terms mean? CVE · CVSS score · exploited (KEV) · EPSS · backported fix · all terms
What to do now
- Check whether you run Linux kernel and which version (commands below).
- Install the fixed version for your system: see “Patch it” below.
- Reboot into the new kernel (uname -r to confirm); live patching (kpatch, Ubuntu Livepatch, SUSE kGraft/klp) can defer the reboot for some CVEs
Affected and fixed versions
Affected:
- Linux Linux 7a4ee419e8c144b747a8915856e91a034d7c8f34 to before 488d2c76bd9f78433a70690d1054bfae3d39a407
- Linux Linux 7a4ee419e8c144b747a8915856e91a034d7c8f34 to before 62f9dfbf1aceae88b03c5ca08f7d36e943939dec
- Linux Linux 7a4ee419e8c144b747a8915856e91a034d7c8f34 to before 8dfd3d8d74435344ee8dc9237596959c8b2a6cbe
- Linux Linux 6.17
Patch it
Use the commands for your system. Distribution packages often keep an older version number with the fix backported, so compare with the fixed package versions in the table below, not only with the upstream version.
Debian
sudo apt update
sudo apt install --only-upgrade linux-image-amd64Ubuntu
sudo apt update
sudo apt install --only-upgrade linux-image-generic (or the installed flavour: linux-image-aws, -azure, -gcp, -virtual)RHEL, AlmaLinux, Rocky, Oracle
sudo dnf upgrade --refresh kernelFedora
sudo dnf upgrade --refresh kernelSUSE / openSUSE
sudo zypper refresh
sudo zypper update kernel-defaultAmazon Linux
sudo dnf upgrade --releasever=latest kernel kernel6.12Arch Linux
sudo pacman -SyuAlpine
apk update && apk upgrade linux-lts linux-virtFreeBSD
not LinuxGeneral update steps for every system are on the Linux and Unix & BSD pages; after updating, see which services to restart.
Fix status in Linux distributions
| Release | Package | Status | Fixed version / advisory |
|---|---|---|---|
| Debian 12 | linux | not affected | |
| Debian 13 | linux | not affected | |
| Debian testing | linux | fixed | 7.0.12-1 |
| Red Hat Enterprise Linux 9 | kernel | fix deferred | |
| Red Hat Enterprise Linux 10 | kernel | fix deferred | |
From the Debian security tracker, Ubuntu CVE tracker and Red Hat Security Data API, refreshed every few hours.
Sources
- https://git.kernel.org/stable/c/488d2c76bd9f78433a70690d1054bfae3d39a407
- https://git.kernel.org/stable/c/62f9dfbf1aceae88b03c5ca08f7d36e943939dec
- https://git.kernel.org/stable/c/8dfd3d8d74435344ee8dc9237596959c8b2a6cbe
- CVE-2026-64186 on CVE.org
- CVE-2026-64186 on NVD
Page generated automatically from official sources on 2026-11-03 18:05 UTC. Always confirm with your vendor's advisory.