Skip to main content

Linux Kernel CVE-2026-64186

| EUVDEUVD-2026-45871 HIGH
Out-of-bounds Read (CWE-125)
2026-07-19 Linux GHSA-398p-2vfw-ch77
Buffer Overflow Information Disclosure Linux Red Hat Amd Suse
High
Disputed · 7.1 NVD
Share

Severity by source

Sources disagree (Low–High)
NVD PRIMARY
7.1 HIGH
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
vuln.today AI
6.3 MEDIUM

AC:H reflects that debugfs must be mounted, AMD IOMMU enabled, and three existing mitigations must all fail for exploitation to succeed.

3.1 AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:H
4.0 AV:L/AC:H/AT:P/PR:L/UI:N/VC:H/VI:N/VA:H/SC:N/SI:N/SA:N
SUSE
0.0 MEDIUM
AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:N
Red Hat
5.5 LOW
qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

Attack Vector
Local
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
None
Availability
High

Lifecycle Timeline

5
Analysis Generated
Aug 11, 2026 - 20:45 vuln.today
CVSS changed
Aug 11, 2026 - 20:07 NVD
7.1 (HIGH)
Patch available
Jul 19, 2026 - 17:03 EUVD
CVE Published
Jul 19, 2026 - 15:41 cve.org
UNKNOWN (no severity yet)
CVE Published
Jul 19, 2026 - 15:41 nvd
HIGH 7.1

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

iommu/amd: Remove latent out-of-bounds access in IOMMU debugfs

In iommu_mmio_write() and iommu_capability_write(), the variables dbg_mmio_offset and dbg_cap_offset are declared as int. However, they are populated using kstrtou32_from_user(). If a user provides a sufficiently large value, it can become a negative integer.

Prior to this patch, the AMD IOMMU debugfs implementation was already protected by different mechanisms.

  1. #define OFS_IN_SZ 8 ensures the user string <= 8 bytes, so

e.g. 0xffffffff isn't a valid input.

if (cnt > OFS_IN_SZ) return -EINVAL;

  1. Implicit type promotion in iommu_mmio_write(), dbg_mmio_offset is int

and iommu->mmio_phys_end is u64

if (dbg_mmio_offset > iommu->mmio_phys_end - sizeof(u64)) return -EINVAL;

  1. The show handlers would currently catch the negative number and

refuse to perform the read.

Replace kstrtou32_from_user() with kstrtos32_from_user() to parse the input, and check for negative values to explicitly prevent out-of-bounds memory accesses directly in iommu_mmio_write() and iommu_capability_write().

AnalysisAI

Out-of-bounds read in the Linux kernel's AMD IOMMU debugfs subsystem exposes local users with standard privileges to potential kernel memory disclosure or denial of service via a sign-extension defect. The functions iommu_mmio_write() and iommu_capability_write() declare offset variables as signed int but populate them with kstrtou32_from_user(), allowing values in the range 0x80000000-0xFFFFFFFF to wrap negative and theoretically index before the intended MMIO region. The vulnerability description explicitly characterizes it as latent, acknowledging that three pre-existing defensive layers already prevent exploitation in practice; the fix replaces the unsigned parser with kstrtos32_from_user() and adds explicit negativity checks. No public exploit exists, no KEV listing is present, and EPSS sits at 0.15% (5th percentile).

Technical ContextAI

The AMD IOMMU subsystem in the Linux kernel exposes a debugfs interface (typically mounted at /sys/kernel/debug) for inspecting IOMMU MMIO registers and capability registers. The vulnerable functions accept user-supplied integer offsets specifying which register to access. These offsets are declared as C int (signed 32-bit) but parsed via kstrtou32_from_user(), which produces an unsigned 32-bit result. When a value between 2,147,483,648 and 4,294,967,295 is assigned to a signed int, it undergoes implementation-defined conversion and becomes negative - a classic C sign-extension/type-mismatch defect classified under CWE-125 (Out-of-Bounds Read). The root cause is the mismatch between the parser's output type and the receiving variable's type. CPE data (cpe:2.3:a:linux:linux:*) identifies the Linux kernel as the affected codebase. EUVD anchors the vulnerability introduction to commit 7a4ee419e8c1, with fixes delivered across three stable branches via commits 488d2c76bd9f, 62f9dfbf1ace, and 8dfd3d8d7443. The AMD IOMMU component requires CONFIG_AMD_IOMMU to be compiled in and debugfs to be mounted.

RemediationAI

The primary remediation is to upgrade to a patched Linux kernel: version 6.18.34, 7.0.11, or 7.1. The three upstream fix commits are available at the kernel.org stable tree: https://git.kernel.org/stable/c/488d2c76bd9f78433a70690d1054bfae3d39a407, https://git.kernel.org/stable/c/62f9dfbf1aceae88b03c5ca08f7d36e943939dec, and https://git.kernel.org/stable/c/8dfd3d8d74435344ee8dc9237596959c8b2a6cbe. Ubuntu users should apply the packages listed in USN-8593-1 at https://ubuntu.com/security/notices/USN-8593-1. Where immediate patching is not feasible, administrators can unmount debugfs (umount /sys/kernel/debug) to remove the write interface entirely, at the cost of disabling all kernel debugging via debugfs - an acceptable trade-off on production systems that should not expose debugfs anyway. Alternatively, restricting the AMD IOMMU debugfs directory permissions to root-only (chmod 700) raises the effective privilege requirement from PR:L to PR:H, substantially reducing attack surface with no functional impact on normal kernel operation.

More in Amd

View all
CVE-2021-22986 CRITICAL POC
9.8 Mar 31

On BIG-IP versions 16.0.x before 16.0.1.1, 15.1.x before 15.1.2.1, 14.1.x before 14.1.4, 13.1.x before 13.1.3.6, and 12.
CVE-2020-6103 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6102 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6101 CRITICAL POC
9.9 Jul 20

An exploitable code execution vulnerability exists in the Shader functionality of AMD Radeon DirectX 11 Driver atidxx64.
CVE-2020-6100 CRITICAL POC
9.9 Jul 20

An exploitable memory corruption vulnerability exists in AMD atidxx64.dll 26.20.15019.19000 graphics driver. Rated criti
CVE-2018-6546 CRITICAL POC
9.8 Apr 13

plays_service.exe in the plays.tv service before 1.27.7.0, as distributed in AMD driver-installation packages and Gaming
CVE-2021-3653 HIGH POC
8.8 Sep 29

A flaw was found in the KVM's AMD code for supporting SVM nested virtualization. Rated high severity (CVSS 8.8), this vu
CVE-2020-12138 HIGH POC
8.8 Apr 27

AMD ATI atillk64.sys 5.11.9.0 allows low-privileged users to interact directly with physical memory by calling one of se
CVE-2019-5098 HIGH POC
8.6 Dec 05

An exploitable out-of-bounds read vulnerability exists in AMD ATIDXX64.DLL driver, version 26.20.13001.29010. Rated high
CVE-2015-7724 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.9 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2015-7723 HIGH POC
7.8 Jun 07

AMD fglrx-driver before 15.7 allows local users to gain privileges via a symlink attack. Rated high severity (CVSS 7.8),
CVE-2023-1048 HIGH POC
7.8 Feb 26

A vulnerability, which was classified as critical, has been found in TechPowerUp Ryzen DRAM Calculator 1.2.0.5.sys. Rate

Same weakness CWE-125 – Out-of-bounds Read

View all
CVE-2014-0160 HIGH POC
7.5
CVE-2016-5198 HIGH POC
8.8
CVE-2025-5777 CRITICAL POC
9.3
CVE-2016-1646 HIGH POC
8.8
CVE-2017-5030 HIGH POC
8.8
CVE-2016-4523 HIGH
7.5
CVE-2024-48456 HIGH POC
7.5
CVE-2024-48457 HIGH POC
7.5

Same technique Buffer Overflow

View all
CVE-2017-7269 CRITICAL POC
9.8
CVE-2015-5119 CRITICAL POC
9.8
CVE-2015-3113 CRITICAL POC
9.8
CVE-2011-2462 CRITICAL POC
9.8
CVE-2020-0796 CRITICAL POC
10.0
CVE-2019-11043 CRITICAL POC
9.8
CVE-2009-0927 HIGH POC
8.8
CVE-2012-1889 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise Desktop 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7 Not-Affected
SUSE Linux Enterprise High Availability Extension 16.0 Not-Affected

Share

CVE-2026-64186 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy