What is the CVSS score of CVE-2026-64291?

CVE-2026-64291 has a CVSS 3.1 base score of 5.5 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-64291?

Yes, a patch is available for CVE-2026-64291. Update the affected software to the latest version immediately.

Linux Kernel CVE-2026-64291

Q: Which versions of Linux Kernel are affected by CVE-2026-64291?

Memory exhaustion in the Linux kernel iommufd subsystem allows a local low-privileged user to crash the system by passing an uncapped veventq_depth value to iommufd_veventq_alloc(), which previously…. A patch is available.

EUVD-2026-49003 MEDIUM

2026-07-25 Linux

GHSA-6gx3-fvx8-mx4p

Information Disclosure Linux

5.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

5.5 MEDIUM

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

vuln.today AI

5.5 MEDIUM

Local low-privilege user triggers memory exhaustion via uncapped ioctl parameter; no confidentiality or integrity impact, availability impact is high.

3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

4.0 AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

SUSE

MEDIUM

qualitative

Red Hat

5.5 LOW

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Aug 12, 2026 - 15:08 vuln.today

CVSS changed

Aug 12, 2026 - 15:07 NVD

5.5 (MEDIUM)

Patch available

Jul 25, 2026 - 11:18 EUVD

CVE Published

Jul 25, 2026 - 08:49 nvd

MEDIUM 5.5

CVE Published

Jul 25, 2026 - 08:49 cve.org

UNKNOWN (no severity yet)

DescriptionNVD

In the Linux kernel, the following vulnerability has been resolved:

iommufd: Set veventq_depth upper bound

iommufd_veventq_alloc() accepts any !0 veventq_depth from userspace, with an upper bound at U32_MAX.

This leaves a vulnerability where userspace can allocate excessively large queues to exhaust kernel memory reserves.

Cap the veventq_depth (maximum number of entries) to 1 << 19, matching the maximum number of entries in the SMMUv3 EVTQ (the largest use case today).

AnalysisAI

Memory exhaustion in the Linux kernel iommufd subsystem allows a local low-privileged user to crash the system by passing an uncapped veventq_depth value to iommufd_veventq_alloc(), which previously accepted any non-zero integer up to U32_MAX without validation. Exploitation requires local access with low privileges on a system where the iommufd device is accessible, making this primarily a concern for multi-tenant or virtualization hosts. No public exploit has been identified and EPSS at 0.21% (11th percentile) reflects minimal real-world exploitation interest at time of analysis.

Technical ContextAI

The iommufd subsystem provides a userspace interface for IOMMU (Input-Output Memory Management Unit) operations, commonly used in device passthrough and VFIO-based virtualization workloads. The function iommufd_veventq_alloc() allocates virtual event queues for IOMMU event notifications, with veventq_depth controlling the maximum number of queue entries. The flaw is the complete absence of an upper bound on this parameter: userspace could supply a value up to U32_MAX (4,294,967,295), causing the kernel to attempt proportionally massive memory allocations. The fix caps veventq_depth at 1 << 19 (524,288 entries), aligning with the SMMUv3 EVTQ (ARM System Memory Management Unit v3 Event Queue) - the largest practical use case. The CPE identifier is cpe:2.3:a:linux:linux:*. No CWE is formally assigned, but the root cause is an input validation weakness on a resource allocation parameter (functionally similar to CWE-770: Allocation of Resources Without Limits or Throttling).

RemediationAI

Apply the vendor-released kernel patches. Patched stable versions are Linux 6.18.39, 7.1.4, and 7.2-rc1; fix commits are available at https://git.kernel.org/stable/c/f565297edf316016be4a1a9e2eb9f39359313f43, https://git.kernel.org/stable/c/e7b5e55652746b1221b9c10ff80eae8a154101ba, and https://git.kernel.org/stable/c/6ebf2eb46fbd5b40393ff8fbb847ba96925beaff. As a compensating control prior to patching, restrict access to the iommufd device node (typically /dev/iommu) using filesystem permissions (chmod/chown) or mandatory access control policies (SELinux, AppArmor, or seccomp filters) to prevent untrusted local users from issuing ioctls to the subsystem. Trade-off: restricting /dev/iommu access will break any legitimate VFIO device passthrough or iommufd-dependent workloads for those users, so this control is only viable where such workloads are not running or can be migrated to privileged accounts.

Same technique Information Disclosure

View all

CVE-2019-2725 CRITICAL POC

9.8

CVE-2021-34523 CRITICAL POC

9.0

CVE-2013-2251 CRITICAL POC

9.8

CVE-2017-5638 CRITICAL POC

9.8

CVE-2025-24813 CRITICAL POC

9.8

CVE-2015-1701 HIGH POC

7.8

CVE-2017-0147 HIGH POC

7.5

CVE-2014-6324 HIGH POC

8.8

Vendor StatusVendor

SUSE

Severity: Moderate

Product	Status
openSUSE Tumbleweed	Fixed
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise Desktop 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected
SUSE Linux Enterprise High Availability Extension 15 SP7	Not-Affected

CVE-2026-64291 vulnerability details – vuln.today

Back

Linux Kernel CVE-2026-64291

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionNVD

AnalysisAI

Technical ContextAI

RemediationAI

Same technique Information Disclosure

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code