https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 07:26:22 +0000 https://vulnerability.circl.lu/vuln/cve-2026-64289 <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>iommufd: Set upper bounds on cache invalidation entry_num and entry_len</p> <p>iommufd_hwpt_invalidate() takes a user-controlled entry_num and entry_len, each bounded only by U32_MAX. An entry_len beyond the kernel&#39;s struct size makes the copy helper verify the extra bytes are zero, scanning that excess in one uninterruptible pass; a multi-gigabyte value over zeroed user memory trips the soft-lockup watchdog.</p> <p>A large entry_num is the other half, driving the backend invalidation loop with no reschedule. The VT-d nested handler, for one, copies each entry and flushes caches per iteration, pinning the CPU on a non-preemptible kernel.</p> <p>Cap both in the ioctl. entry_len is held under PAGE_SIZE, above any request struct, and entry_num under 1 &lt;&lt; 19, the order of a hardware invalidation queue and well beyond any real batch, bounding the per-call loop length.</p> <p><strong>Affected:</strong> Linux</p> <p>In the Linux kernel, the following vulnerability has been resolved:</p> <p>iommufd: Set upper bounds on cache invalidation entry_num and entry_len</p> <p>iommufd_hwpt_invalidate() takes a user-controlled entry_num and entry_len, each bounded only by U32_MAX. An entry_len beyond the kernel&#39;s struct size makes the copy helper verify the extra bytes are zero, scanning that excess in one uninterruptible pass; a multi-gigabyte value over zeroed user memory trips the soft-lockup watchdog.</p> <p>A large entry_num is the other half, driving the backend invalidation loop with no reschedule. The VT-d nested handler, for one, copies each entry and flushes caches per iteration, pinning the CPU on a non-preemptible kernel.</p> <p>Cap both in the ioctl. entry_len is held under PAGE_SIZE, above any request struct, and entry_num under 1 &lt;&lt; 19, the order of a hardware invalidation queue and well beyond any real batch, bounding the per-call loop length.</p> https://vulnerability.circl.lu/vuln/cve-2026-64289