Baitaphish
Security intelligence
SearchLatest briefing
CVE Explorer

CVE-2026-64186

In the Linux kernel, the following vulnerability has been resolved: iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs In iommu_mmio_write() and iommu_capability_write(), the variables dbg_mmio_offset and dbg_cap_offset are declared as int. However, they are populated using kstrtou32_from_user(). If a user provides a sufficiently large value, it can become a negative integer. Prior to this patch, the AMD IOMMU debugfs implementation was already protected by different mechanisms.
Lifecycle PUBLISHED1 preserved revisionFact urn:baitaphish:canonical-cve-fact-revision:v2:1061a9e000e9c04bbbaab01ac413a4a78e3c9ce8c6b7bf6ceca44ba793f2ada8
Known exploited
Not asserted
Disputed
No
Stale source
No
Conflicts
1

Preserved source conflicts

No provider value was silently selected as the winner.

affected · 2 assertions

{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iommu/amd/debugfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"488d2c76bd9f78433a70690d1054bfae3d39a407","status":"affected","version":"7a4ee419e8c144b747a8915856e91a034d7c8f34","versionType":"git"},{"lessThan":"62f9dfbf1aceae88b03c5ca08f7d36e943939dec","status":"affected","version":"7a4ee419e8c144b747a8915856e91a034d7c8f34","versionType":"git"},{"lessThan":"8dfd3d8d74435344ee8dc9237596959c8b2a6cbe","status":"affected","version":"7a4ee419e8c144b747…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0c39ff92c9c80a81c3d4bac3011f616732fab0b4eb7ecc71b82a2569951c5a6c · sha256:49211906857856e1… · /containers/cna/affected/0

{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iommu/amd/debugfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"…

  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0c39ff92c9c80a81c3d4bac3011f616732fab0b4eb7ecc71b82a2569951c5a6c · sha256:49211906857856e1… · /containers/cna/affected/1

Affected products and versions

2 source assertions
{"defaultStatus":"unaffected","product":"Linux","programFiles":["drivers/iommu/amd/debugfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"lessThan":"488d2c76bd9f78433a70690d1054bfae3d39a407","status":"affected","version":"7a4ee419e8c144b747a8915856e91a034d7c8f34","versionType":"git"},{"lessThan":"62f9dfbf1aceae88b03c5ca08f7d36e943939dec","status":"affected","version":"7a4ee419e8c144b747a8915856e91a034d7c8f34","versionType":"git"},{"lessThan":"8dfd3d8d74435344ee8dc9237596959c8b2a6cbe","status":"affected","version":"7a4ee419e8c144b747…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0c39ff92c9c80a81c3d4bac3011f616732fab0b4eb7ecc71b82a2569951c5a6c · sha256:49211906857856e1… · /containers/cna/affected/0
{"defaultStatus":"affected","product":"Linux","programFiles":["drivers/iommu/amd/debugfs.c"],"repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","vendor":"Linux","versions":[{"status":"affected","version":"6.17"},{"lessThan":"6.17","status":"unaffected","version":"0","versionType":"semver"},{"lessThanOrEqual":"6.18.*","status":"unaffected","version":"6.18.34","versionType":"semver"},{"lessThanOrEqual":"7.0.*","status":"unaffected","version":"7.0.11","versionType":"semver"},{"lessThanOrEqual":"*","status":"unaffected","version":"7.1","versionType":"original_commit_for_fix"…
  • cve_program_cvelist_v5affected
    urn:baitaphish:normalized-source-record:v2:0c39ff92c9c80a81c3d4bac3011f616732fab0b4eb7ecc71b82a2569951c5a6c · sha256:49211906857856e1… · /containers/cna/affected/1

Source references

3 source assertions
{"url":"https://git.kernel.org/stable/c/488d2c76bd9f78433a70690d1054bfae3d39a407"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0c39ff92c9c80a81c3d4bac3011f616732fab0b4eb7ecc71b82a2569951c5a6c · sha256:49211906857856e1… · /containers/cna/references/0
{"url":"https://git.kernel.org/stable/c/62f9dfbf1aceae88b03c5ca08f7d36e943939dec"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0c39ff92c9c80a81c3d4bac3011f616732fab0b4eb7ecc71b82a2569951c5a6c · sha256:49211906857856e1… · /containers/cna/references/1
{"url":"https://git.kernel.org/stable/c/8dfd3d8d74435344ee8dc9237596959c8b2a6cbe"}
  • cve_program_cvelist_v5reference
    urn:baitaphish:normalized-source-record:v2:0c39ff92c9c80a81c3d4bac3011f616732fab0b4eb7ecc71b82a2569951c5a6c · sha256:49211906857856e1… · /containers/cna/references/2

Attribution and limitations

  • CVE Program CVEList V5: Reproduce the MITRE copyright designation and CVE license in copies. Source →

Provider severity values are preserved separately. Baitaphish does not convert them into a risk rating, infer affected products, or treat EPSS as observed exploitation.

← Back to CVE Explorer