Linux Kernel CVE-2026-64289

IOMMUFD (I/O Memory Management Unit File Descriptor) is the Linux kernel subsystem for managing hardware IOMMU page tables, primarily used in device passthrough and nested virtualization scenarios (VFIO, KVM). The vulnerable function iommufd_hwpt_invalidate() handles an ioctl that invalidates hardware page table cache entries. It accepts two u32 user-space parameters - entry_len (per-entry struct size) and entry_num (iteration count) - with no upper-bound validation prior to the fix. An entry_len exceeding the kernel's internal struct size causes the copy-from-user helper to verify that excess bytes are zeroed in a single uninterruptible pass, which on multi-gigabyte values trips the kernel soft-lockup watchdog. A large entry_num drives the VT-d nested invalidation handler into a tight per-entry copy-and-cache-flush loop with no scheduling yield, pinning a CPU core on non-preemptible kernel configurations. The root cause is missing input range validation on ioctl parameters - analogous to CWE-400 (Uncontrolled Resource Consumption) - introduced when iommufd cache invalidation support landed around kernel 6.8 (commit 8c6eabae3807e048b9f17733af5e20500fbf858c). CPE: cpe:2.3:a:linux:linux.